ID CVE-2008-3800
Summary Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service (device or process reload) via unspecified valid SIP messages, aka Cisco Bug ID CSCsu38644, a different vulnerability than CVE-2008-3801 and CVE-2008-3802.
References
Vulnerable Configurations
  • cpe:2.3:h:cisco:ios:12.2
    cpe:2.3:h:cisco:ios:12.2
  • cpe:2.3:h:cisco:ios:12.4
    cpe:2.3:h:cisco:ios:12.4
  • cpe:2.3:h:cisco:ios:12.3
    cpe:2.3:h:cisco:ios:12.3
  • cpe:2.3:a:cisco:unified_communications_manager:4.1
    cpe:2.3:a:cisco:unified_communications_manager:4.1
  • cpe:2.3:a:cisco:unified_communications_manager:6.1
    cpe:2.3:a:cisco:unified_communications_manager:6.1
  • Cisco Unified Communications Manager 5.0
    cpe:2.3:a:cisco:unified_communications_manager:5.0
  • Cisco Unified Communications Manager 5.1
    cpe:2.3:a:cisco:unified_communications_manager:5.1
  • Cisco Unified CallManager 4.1
    cpe:2.3:a:cisco:unified_callmanager:4.1
  • Cisco Unified CallManager 4.2
    cpe:2.3:a:cisco:unified_callmanager:4.2
  • Cisco Unified CallManager 4.3
    cpe:2.3:a:cisco:unified_callmanager:4.3
CVSS
Base: 7.1 (as of 29-09-2008 - 13:53)
Impact:
Exploitability:
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
nessus via4
NASL family CISCO
NASL id CISCO-SA-20080924-SIPHTTP.NASL
description Multiple vulnerabilities exist in the Session Initiation Protocol (SIP) implementation in Cisco IOS that can be exploited remotely to trigger a memory leak or to cause a reload of the IOS device. Cisco has released free software updates that address these vulnerabilities. Fixed Cisco IOS software listed in the Software Versions and Fixes section contains fixes for all vulnerabilities addressed in this advisory. There are no workarounds available to mitigate the effects of any of the vulnerabilities apart from disabling the protocol or feature itself, if administrators do not require the Cisco IOS device to provide voice over IP services.
last seen 2019-02-21
modified 2018-11-15
plugin id 49025
published 2010-09-01
reporter Tenable
source https://www.tenable.com/plugins/index.php?view=single&id=49025
title Multiple Cisco IOS Session Initiation Protocol Denial of Service Vulnerabilities
oval via4
accepted 2010-06-21T04:00:02.561-04:00
class vulnerability
contributors
  • name Yuzheng Zhou
    organization Hewlett-Packard
  • name KASHIF LATIF
    organization DTCC
description Unspecified vulnerability in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4 and Unified Communications Manager 4.1 through 6.1, when VoIP is configured, allows remote attackers to cause a denial of service (device or process reload) via unspecified valid SIP messages, aka Cisco Bug ID CSCsu38644, a different vulnerability than CVE-2008-3801 and CVE-2008-3802.
family ios
id oval:org.mitre.oval:def:6086
status accepted
submitted 2008-09-24T11:06:36.000-04:00
title Cisco IOS Session Initiation Protocol Denial of Service Vulnerability
version 8
refmap via4
bid 31367
cisco
  • 20080924 Cisco Unified Communications Manager Session Initiation Protocol Denial of Service Vulnerabilities
  • 20080924 Multiple Cisco IOS Session Initiation Protocol Denial of Service Vulnerabilities
sectrack
  • 1020939
  • 1020942
secunia
  • 31990
  • 32013
vupen
  • ADV-2008-2670
  • ADV-2008-2671
Last major update 29-10-2012 - 23:15
Published 26-09-2008 - 12:21
Last modified 28-09-2017 - 21:31
Back to Top