Cisco IOS SIP Message Denial of Service Vulnerability

Bugtraq ID:	36499
Class:	Design Error
CVE:	CVE-2009-2870
Remote:	Yes
Local:	No
Published:	Sep 23 2009 12:00AM
Updated:	Sep 23 2009 07:00PM
Credit:	Cisco
Vulnerable:	Cisco IOS 12.4YB Cisco IOS 12.4YA Cisco IOS 12.4XZ Cisco IOS 12.4XY Cisco IOS 12.4XW Cisco IOS 12.4XV Cisco IOS 12.4XT Cisco IOS 12.4XP Cisco IOS 12.4XM Cisco IOS 12.4XL Cisco IOS 12.4XJ Cisco IOS 12.4XE Cisco IOS 12.4XD Cisco IOS 12.4XC Cisco IOS 12.4XB Cisco IOS 12.4XA Cisco IOS 12.4T Cisco IOS 12.4MR Cisco IOS 12.4GC Cisco IOS 12.3YT Cisco IOS 12.3YS Cisco IOS 12.3YK
Not Vulnerable:	Cisco IOS 12.4(24)T1 Cisco IOS 12.4(24)GC1 Cisco IOS 12.4(22)YB1 Cisco IOS 12.4(22)T2 Cisco IOS 12.4(20)T3 Cisco IOS 12.4(19)MR3 Cisco IOS 12.4(15)XM Cisco IOS 12.4(15)XL5 Cisco IOS 12.4(15)T10 Cisco IOS 12.3(11)YS1 Cisco IOS 12.3(11)YK3

Cisco IOS SIP Message Denial of Service Vulnerability

Cisco IOS is prone to a denial-of-service vulnerability.

An attacker can exploit this issue to cause an affected device to crash and reload, denying service to legitimate users.

This issue is tracked by Cisco Bug ID CSCsx25880.

Cisco IOS SIP Message Denial of Service Vulnerability

To exploit this issue, attackers can use readily available network utilities.

Cisco IOS SIP Message Denial of Service Vulnerability

Solution:
The vendor has released updates. Please see the referenced advisory for details.

Cisco IOS SIP Message Denial of Service Vulnerability

References:

• Cisco Applied Mitigation Bulletin: Identifying and Mitigating Exploitation of th (Cisco)
  
• Cisco IOS Homepage (Cisco Systems)
  
• Cisco Security Advisory: Cisco IOS Software Session Initiation Protocol Denial o (Cisco)