Title: ------ * Cisco Unified IP Phone 7960G and 7940G (SIP) RTP Header Vulnerability Summary: -------- * The Cisco Unified IP Phone 7960G and 7940G (SIP) do not correctly parse some malformed RTP headers leading to a deterministic denial of service Assigned CVE: ------------- * CVE-2008-4444 Details: -------- * SIP protocol is used to set up calls between phones. Once the call is established, the media content is carried by the RTP protocol. A remote attacker could send a specially crafted RTP packet against a Cisco SIP phone in such a way as to cause the phone to reboot. Attack Impact: -------------- * Denial-of-service (reboot or hang-up) and possibly remote arbitrary code execution Attack Vector: -------------- * Have the possibility to setup a call to the targeted phone and carry RTP frame to the vulnerable device * Have access to the VoIP network while a call is established and inject RTP frames Timeline: --------- * 2008-06-13 - Vulnerability reported to Cisco * 2008-06-16 - Full details sent to Cisco * 2008-10-21 - Cisco released a patched firmware * 2009-01-14 - Release of this security advisory Affected Products: ------------------ * Cisco Unified IP Phone 7960G and 7940G (SIP) with P0S3-08-9-00 firmware. Cisco released a patched firmware on October 21, 2008 which is described in the bug identifier CSCsu22285 (Cisco Unified IP Phone 7960G and 7940G (SIP) Release Notes for Firmware Release 8.10). Credits: -------- * This vulnerability was discovered by Gabriel Campana and Laurent Butti from France Telecom / Orange