Cisco IP Phone SYN flood denial of service
| cisco-ipphone-synflood-dos (24117) |  Low Risk |
Description:
The Cisco IP Phones 7940 and 7960 are vulnerable to a denial of service attack. A remote attacker could flood any port on affected device with SYN packets to cause the device to reboot, resulting in a denial of service.
Platforms Affected:
- Cisco, IP Phone 7940
- Cisco, IP Phone 7960
Remedy:
Upgrade to the latest firmware version (7.1(1) or later), as listed in the Cisco Security Notice dated 2006 January 13 2130 UTC (GMT). See References.
Consequences:
Denial of Service
References:
- Cisco Security Notice 2006 January 13 2130 UTC (GMT), Response to Cisco IP Phone 7940 DoS Exploit posted on milw0rm.com at http://www.cisco.com/warp/public/707/cisco-response-20060113-ip-phones.shtml.
- BID-16200: Cisco IP Phone 7940 Remote Denial of Service Vulnerability
- CVE-2006-0179: The Cisco IP Phone 7940 allows remote attackers to cause a denial of service (reboot) via a large amount of TCP SYN packets (syn flood) to arbitrary ports, as demonstrated to port 80.
- OSVDB ID: 22469: Cisco 79xx IP Phone SYN Flood Device Reboot Remote DoS
- SA18479: Cisco IP Phones SYN Flood Device Reload Vulnerability
- SECTRACK ID: 1015488: Cisco 7940/7960 IP Phones Can Be Crashed by Remote Users
- VUPEN/ADV-2006-0202: Cisco IP Phones SYN Flood Remote Denial of Service Vulnerability
Reported:
Jan 13, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net