PT-2008-5153 · Cisco · Cisco Ios

Published 2008-09-24 · Updated 2022-06-02 · CVE-2008-3799

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco IOS versions 12.2 through 12.4

Description A memory leak in the Session Initiation Protocol (SIP) implementation allows remote attackers to cause a denial of service (memory consumption and voice-service outage) via unspecified valid SIP messages. Multiple vulnerabilities exist in the SIP implementation that can be exploited remotely to trigger a memory leak or to cause a reload of the IOS device.

Recommendations For Cisco IOS versions 12.2 through 12.4, update to a fixed version of Cisco IOS software that contains fixes for all vulnerabilities addressed in this advisory. As a temporary workaround, consider disabling the SIP protocol or feature itself if administrators do not require the Cisco IOS device to provide voice over IP services.

Fix

DoS

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2008-3799

Affected Products

Cisco Ios

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-3799 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20080924-sip · Vendor Advisory
• http://cisco.com/en/US/products/products_security_advisory09186a0080a01562.shtml · Vendor Advisory
• http://secunia.com/advisories/31990 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5927 · Note
• http://securitytracker.com/id?1020939 · Note
• http://vupen.com/english/advisories/2008/2670 · Note