CVE-2007-5638: Infoleak
First published: Tue Oct 23 2007(Updated: )
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines, use only 65536 different values in the 32-bit ID number field of an RUDP datagram, which makes it easier for remote attackers to guess the RUDP ID and spoof messages. NOTE: this can be leveraged for an eavesdropping attack by sending many Open Audio Stream messages.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Nortel Multimedia Communication Server 5100 | ||
| Nortel Multimedia Communications Server | ||
| Nortel CS1000 | =1000e | |
| Nortel CS1000 | =1000m | |
| Nortel CS1000 | =1000s | |
| Nortel CS1000 | =2100 | |
| Nortel IP Audio Conference Phone 2033 | ||
| Nortel IP Phone 1110 | ||
| Nortel IP Phone 1120E | ||
| Nortel IP Phone 1140E | ||
| Nortel IP Phone 1150E | ||
| Nortel IP phone 2001 | ||
| Nortel IP phone 2002 | ||
| Nortel IP Phone 2004 | ||
| Nortel IP Phone 2007 | ||
| Nortel WLAN Handset 2210 | ||
| Nortel WLAN Handset 2211 | ||
| Nortel WLAN Handset 2212 | ||
| Nortel WLAN Handset 6120 | ||
| Nortel WLAN Handset 6140 | ||
| Nortel Business Communications Manager | =50 | |
| Nortel Business Communications Manager | =50a | |
| Nortel Business Communications Manager | =50e | |
| Nortel Business Communications Manager | =200 | |
| Nortel Business Communications Manager | =400 | |
| Nortel Business Communications Manager | =1000 | |
| Nortel Business Communications Manager | =srg50 | |
| Nortel Business Communications Manager | =srg200 | |
| Nortel Centrex IP Client Manager | ||
| Nortel Centrex IP Element Manager | ||
| Nortel Meridian | ||
| Nortel Meridian | ||
| Nortel Meridian | ||
| Nortel Meridian | ||
| Nortel Meridian | =cs2100 | |
| Nortel Mobile Voice Client 2050 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.csnc.ch/static/advisory/csnc/nortel_IP_phone_surveillance_mode_v1.0.txt
- http://www.securityfocus.com/bid/26120
- http://secunia.com/advisories/27234
- http://securityreason.com/securityalert/3272
- http://osvdb.org/41770
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42881
- https://exchange.xforce.ibmcloud.com/vulnerabilities/37255
- http://www.securityfocus.com/archive/1/482478/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2007-5638?
The severity of CVE-2007-5638 is considered moderate as it allows for potential remote attacks through exploitation of ID number field limitations.
How do I fix CVE-2007-5638?
To fix CVE-2007-5638, ensure that your Nortel products are updated to the latest firmware version that addresses this vulnerability.
What Nortel products are affected by CVE-2007-5638?
Affected products include Nortel IP Softphone 2050, IP Phone 1140E, and various models from the Nortel Business Communications Manager and Meridian series.
Can CVE-2007-5638 be exploited remotely?
Yes, CVE-2007-5638 can be exploited remotely due to its nature of allowing attackers to guess ID numbers in RUDP datagrams.
What are the potential impacts of CVE-2007-5638?
The potential impacts of CVE-2007-5638 include unauthorized access and the ability to disrupt communication services through successful attacks.
- collector/nvd-historical
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/author
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/nortel
- canonical/nortel multimedia communication server 5100
- canonical/nortel multimedia communications server
- canonical/nortel cs1000
- version/nortel cs1000/1000e
- version/nortel cs1000/1000m
- version/nortel cs1000/1000s
- version/nortel cs1000/2100
- canonical/nortel ip audio conference phone 2033
- canonical/nortel ip phone 1110
- canonical/nortel ip phone 1120e
- canonical/nortel ip phone 1140e
- canonical/nortel ip phone 1150e
- canonical/nortel ip phone 2001
- canonical/nortel ip phone 2002
- canonical/nortel ip phone 2004
- canonical/nortel ip phone 2007
- canonical/nortel wlan handset 2210
- canonical/nortel wlan handset 2211
- canonical/nortel wlan handset 2212
- canonical/nortel wlan handset 6120
- canonical/nortel wlan handset 6140
- canonical/nortel business communications manager
- version/nortel business communications manager/50
- version/nortel business communications manager/50a
- version/nortel business communications manager/50e
- version/nortel business communications manager/200
- version/nortel business communications manager/400
- version/nortel business communications manager/1000
- version/nortel business communications manager/srg50
- version/nortel business communications manager/srg200
- canonical/nortel centrex ip client manager
- canonical/nortel centrex ip element manager
- canonical/nortel meridian
- version/nortel meridian/cs2100
- canonical/nortel mobile voice client 2050