PT-2002-2656 · Pingtel · Pingtel Xpressa

Published 2002-12-31 · Updated 2024-02-14 · CVE-2002-1935

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Pingtel Xpressa versions 1.2.5 through 2.0.1

Description The issue allows remote attackers to avoid registering with the SIP registrar by exploiting predictable values in a Session Identification Protocol (SIP) request, specifically the Call-ID, CSeq, and "To" and "From" SIP URL values.

Recommendations For versions 1.2.5 through 2.0.1, consider implementing a randomization mechanism for the Call-ID, CSeq, and "To" and "From" SIP URL values in SIP requests to prevent predictability. As a temporary workaround, restrict access to the SIP registrar to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2002-1935

Affected Products

Pingtel Xpressa

References · 5

• http://sys-security.com/archive/advisories/More_Vulnerabilities_with_Pingtel_xpressa_SIP-based_IP_phones.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-1935 · Security Note
• http://securityfocus.com/bid/5537 · Note
• http://online.securityfocus.com/archive/1/288383 · Note
• http://iss.net/security_center/static/9949.php · Note