Nortel UNIStim IP Phone Remote Ping Denial of Service Vulnerability

Bugtraq ID:	28004
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2008-4999
Remote:	Yes
Local:	No
Published:	Feb 26 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	[email protected] disclosed this issue.
Vulnerable:	Nortel Networks UNIStim IP Phone 0604DAS
Not Vulnerable:

Nortel UNIStim IP Phone Remote Ping Denial of Service Vulnerability

Nortel UNIStim IP Phone products are prone to a remote denial-of-service vulnerability because the software fails to properly handle unexpected network datagrams.

Successfully exploiting this issue allows remote attackers to crash affected phones, denying service to legitimate users.

Phones with firmware 0604DAS are vulnerable to this issue. Other versions are also reportedly affected, but we don't know which specific versions.

Nortel UNIStim IP Phone Remote Ping Denial of Service Vulnerability

To exploit this issue, attackers can use readily available network utilities.

The following command will demonstrate this issue:

ping -s 65500 <target>

Nortel UNIStim IP Phone Remote Ping Denial of Service Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Nortel UNIStim IP Phone Remote Ping Denial of Service Vulnerability

References:

• Nortel Networks Homepage (Nortel Networks)
  
• Nortel IP Phone DoS ([email protected])