PT-2002-1696 · Pingtel · Pingtel Xpressa

Publicado 2002-07-15 · Atualizado 2008-09-05 · CVE-2002-0670

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Pingtel xpressa SIP-based voice-over-IP phone versions 1.2.5 through 1.2.7.4

Description The issue concerns the web interface of the Pingtel xpressa SIP-based voice-over-IP phone, which uses Base64 encoded usernames and passwords for HTTP basic authentication. This allows remote attackers to steal and easily decode the passwords via sniffing.

Recommendations For versions 1.2.5 through 1.2.7.4, consider disabling HTTP basic authentication in the web interface until a more secure authentication method is implemented. Restrict access to the web interface to minimize the risk of exploitation. Avoid using the web interface for sensitive operations until the issue is resolved.

Correção

Identificadores relacionados

CVE-2002-0670

Produtos afetados

Pingtel Xpressa

Referências · 4

• http://pingtel.com/PingtelAtStakeAdvisoryResponse.jsp · Aviso do Fabricante
• http://iss.net/security_center/static/9565.php · Nota
• http://atstake.com/research/advisories/2002/a071202-1.txt · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-0670 · Nota de Segurança