SB2018051717 - Denial of service in Cisco SIP IP Phone
Published: May 17, 2018
Security Bulletin ID
SB2018051717
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Denial of service
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper input validation (CVE-ID: CVE-2018-0325)
The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.
The weakness exists in the Session Initiation Protocol (SIP) call-handling functionality due to incomplete input validation of SIP Session Description Protocol (SDP) parameters by the SDP parser. A remote attacker can send a specially crafted SIP packet, cause all active phone calls on the affected phone to be dropped while the SIP process on the phone unexpectedly restarts and cause the service to crash.
Remediation
Install update from vendor's website.