CVE-2007-5640: High severity Nortel Multimedia Communication Server 5100 vulnerability

Published Oct 23, 2007

Updated

The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), Mobile Voice Client, and other product lines, allow remote attackers to block calls and force re-registration via a resume message to the Signaling Server that has a spoofed source IP address for the phone. NOTE: the attack is more disruptive if a new spoofed resume message is sent after each re-registration.

Affected Software

36 affected components

Nortel Multimedia Communication Server 5100

Nortel Multimedia Communication Server 5200

Nortel Communications Server=1000e

Nortel Communications Server=1000m

Nortel Communications Server=1000s

Nortel Communications Server=2100

Nortel Ip Audio Conference Phone 2033

Nortel Ip Phone 1110

Nortel Ip Phone 1120e

Nortel IP Phone 1140E

Nortel Ip Phone 1150e

Nortel Ip Phone 2001

Nortel Ip Phone 2002

Nortel Ip Phone 2004

Nortel Ip Phone 2007

Nortel Wlan Handset 2210

Nortel Wlan Handset 2211

Nortel Wlan Handset 2212

Nortel Wlan Handset 6120

Nortel Wlan Handset 6140

Nortel Business Communications Manager=50

Nortel Business Communications Manager=50a

Nortel Business Communications Manager=50e

Nortel Business Communications Manager=200

Nortel Business Communications Manager=400

Nortel Business Communications Manager=1000

Nortel Business Communications Manager=srg50

Nortel Business Communications Manager=srg200

Nortel Centrex Ip Client Manager

Nortel Centrex Ip Element Manager

Nortel Meridian Option 11c

Nortel Meridian Option 51c

Nortel Meridian Option 61c

Nortel Meridian Option 81c

Nortel Meridian Sl100=cs2100

Nortel Mobile Voice Client 2050

Remediation

Patch Available

http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&id=654641

Event History

Oct 23, 2007

CVE Published

05:46 PM

Data Sourced

05:46 PM

DescriptionWeaknessAffected Software

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5640?

CVE-2007-5640 is classified with a medium severity level, indicating a potential impact on availability.

How do I fix CVE-2007-5640?

To mitigate CVE-2007-5640, ensure that your Nortel products are updated to the latest firmware versions and configurations recommended by Nortel.

What products are affected by CVE-2007-5640?

CVE-2007-5640 affects Nortel UNIStim IP Softphone 2050, IP Phone 1140E, Business Communications Manager, and various other Nortel products.

Can CVE-2007-5640 be exploited remotely?

Yes, CVE-2007-5640 can be exploited by remote attackers to block calls and force re-registration.

What type of attack does CVE-2007-5640 enable?

CVE-2007-5640 enables attackers to disrupt VoIP service by blocking calls and manipulating session registrations from a distance.