PT-2007-4626 · Aastra · Aastra 9112I Sip Phone

Published 2007-06-22 · Updated 2017-07-29 · CVE-2007-3349

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Aastra 9112i SIP Phone with firmware 1.4.0.1048 and boot version 1.1.0.10

Description The issue allows remote attackers to cause a denial of service, either by freezing the device or triggering a continuous ring, via malformed SIP messages of specific lengths.

Recommendations For Aastra 9112i SIP Phone with firmware 1.4.0.1048 and boot version 1.1.0.10, consider restricting the reception of SIP messages from untrusted sources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2007-3349

Affected Products

Aastra 9112I Sip Phone

References · 7

• http://securityfocus.com/bid/24537 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-3349 · Security Note
• http://sipera.com/index.php?action=resources%2Cthreat_advisory&tid=277& · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35060 · Note
• http://vupen.com/english/advisories/2007/2318 · Note
• http://secunia.com/advisories/25806 · Note
• http://osvdb.org/37496 · Note