PT-2017-12436 · Cisco · Cisco Small Business Spa51X+2

Publicado 2017-10-19 · Atualizado 2019-10-09 · CVE-2017-12260

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones versions 7.6.2SR1 and earlier

Description A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial of service (DoS) condition. The issue is due to the improper handling of SIP request messages by an affected device. An attacker could exploit this by using formatted specifiers in a SIP payload sent to an affected device, causing it to become unresponsive until manually restarted.

Recommendations For Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones versions 7.6.2SR1 and earlier, update to a firmware release later than 7.6.2SR1 to resolve the issue. As a temporary workaround, consider restricting access to the SIP functionality to minimize the risk of exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-12260

Produtos afetados

Cisco Small Business Spa50X

Cisco Small Business Spa51X

Cisco Small Business Spa52X

Referências · 5

• https://osv.dev/vulnerability/CVE-2017-12260 · Aviso do Fabricante
• http://securityfocus.com/bid/101495 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-12260 · Nota de Segurança
• http://securitytracker.com/id/1039616 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-sip1 · Aviso do Fabricante