SIP Packets Reload IOS Devices with support for SIP

This script is (C) 2010-2014 Tenable Network Security, Inc.


Synopsis :

The remote device is missing a vendor-supplied security patch.

Description :

Cisco devices running an affected version of Internetwork Operating
System (IOS) which supports Session Initiation Protocol (SIP) are
affected by a vulnerability that may lead to a reload of the device
when receiving a specific series of packets destined to port 5060. This
issue is compounded by a related bug which allows traffic to TCP 5060
and UDP port 5060 on devices not configured for SIP.
There are no known instances of intentional exploitation of this issue.
However, Cisco has observed data streams that appear to be
unintentionally triggering the vulnerability.
Workarounds exist to mitigate the effects of this problem on devices
which do not require SIP.

See also :

http://www.nessus.org/u?15ec02fb
http://www.nessus.org/u?40ba435b

Solution :

Apply the relevant patch referenced in Cisco Security Advisory
cisco-sa-20070131-sip.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
CVSS Temporal Score : 6.4
(CVSS2#E:F/RL:OF/RC:C)
Public Exploit Available : true

Family: CISCO

Nessus Plugin ID: 48999 (cisco-sa-20070131-siphttp.nasl)

Bugtraq ID: 22330

CVE ID: CVE-2007-0648