Cisco Unified IP Phone 7960G and 7940G (SIP) RTP Header Vulnerability

Title:

• Cisco Unified IP Phone 7960G and 7940G (SIP) RTP Header Vulnerability

Summary:

• The Cisco Unified IP Phone 7960G and 7940G (SIP) do not correctly
  parse some malformed RTP headers leading to a deterministic denial of
  service

Assigned CVE:

• CVE-2008-4444

Details:

• SIP protocol is used to set up calls between phones. Once the call is
  established, the media content is carried by the RTP protocol. A remote
  attacker could send a specially crafted RTP packet against a Cisco SIP
  phone in such a way as to cause the phone to reboot.

Attack Impact:

• Denial-of-service (reboot or hang-up) and possibly remote arbitrary
  code execution

Attack Vector:

• Have the possibility to setup a call to the targeted phone and carry
  RTP frame to the vulnerable device
• Have access to the VoIP network while a call is established and inject
  RTP frames

Timeline:

• 2008-06-13 - Vulnerability reported to Cisco
• 2008-06-16 - Full details sent to Cisco
• 2008-10-21 - Cisco released a patched firmware
• 2009-01-14 - Release of this security advisory

Affected Products:

• Cisco Unified IP Phone 7960G and 7940G (SIP) with P0S3-08-9-00
  firmware. Cisco released a patched firmware on October 21, 2008 which is
  described in the bug identifier CSCsu22285 (Cisco Unified IP Phone 7960G
  and 7940G (SIP) Release Notes for Firmware Release 8.10).

Credits:

• This vulnerability was discovered by Gabriel Campana and Laurent Butti
  from France Telecom / Orange