SB2018051717 - Denial of service in Cisco SIP IP Phone

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018051717

SB2018051717 - Denial of service in Cisco SIP IP Phone

Published: May 17, 2018

Security Bulletin ID SB2018051717
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Partial DoS

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper input validation (CVE-ID: CVE-2018-0325)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the Session Initiation Protocol (SIP) call-handling functionality due to incomplete input validation of SIP Session Description Protocol (SDP) parameters by the SDP parser. A remote attacker can send a specially crafted SIP packet, cause all active phone calls on the affected phone to be dropped while the SIP process on the phone unexpectedly restarts and cause the service to crash.


Remediation

Install update from vendor's website.

References