Description
Cisco IP Phone 7940 and 7960 with P0S3-08-6-00 firmware, and other SIP firmware before 8.7(0), allows remote attackers to cause a denial of service (device reboot) via (1) a certain sequence of 10 invalid SIP INVITE and OPTIONS messages; or (2) a certain invalid SIP INVITE message that contains a remote tag, followed by a certain set of two related SIP OPTIONS messages.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Cisco IP Phone 7940 - 3 SIP Messages Remote Denial of Service EDB-4297 · dos · Aug 21, 2007 · verified
- Cisco IP Phone 7940 - 10 SIP Messages Remote Denial of Service EDB-4298 · dos · Aug 21, 2007 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 25378 vdb-entry
- cisco-ipphone-sip-dos(36125) vdb-entry
- 20070821 Multiple SIP Vulnerabilities in the Cisco 7960 IP Phones vendor-advisory
- 26547 third-party-advisory
- 20070820 10 messages SIP Remote DOS on Cisco 7940 SIP Phone mailing-list
- 3042 third-party-advisory
- 20070820 3 messsages attack remote DOS on Cisco 7940 mailing-list
- 1018591 vdb-entry
- ADV-2007-2928 vdb-entry
- 36695 vdb-entry