CVE-2008-0527: Input Validation

Published Feb 15, 2008

Updated

The HTTP server in Cisco Unified IP Phone 7935 and 7936 running SCCP firmware allows remote attackers to cause a denial of service (reboot) via a crafted HTTP request.

Affected Software

14 affected components

Cisco Unified IP Phone=7906g

Cisco Unified IP Phone=7911g

Cisco Unified IP Phone=7935

Cisco Unified IP Phone=7936

Cisco Unified IP Phone=7940

Cisco Unified IP Phone=7940g

Cisco Unified IP Phone=7941g

Cisco Unified IP Phone=7960

Cisco Unified IP Phone=7960g

Cisco Unified IP Phone=7961g

Cisco Unified IP Phone=7970g

Cisco Unified IP Phone=7971g

Cisco Skinny Client Control Protocol \(sccp\) Firmware

Cisco Session Initiation Protocol \(sip\) Firmware

Remediation

Patch Available

http://www.cisco.com/en/US/products/products_security_advisory09186a0080949c7a.shtml

Event History

Feb 15, 2008

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Data Sourced

02:00 AM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-0527?

CVE-2008-0527 is classified as a denial of service vulnerability affecting certain Cisco Unified IP Phone models.

How do I fix CVE-2008-0527?

To mitigate CVE-2008-0527, it is recommended to update the firmware of the affected Cisco Unified IP Phones to the latest version provided by Cisco.

Which devices are affected by CVE-2008-0527?

CVE-2008-0527 specifically affects Cisco Unified IP Phone models 7935 and 7936 running SCCP firmware.

What is the impact of CVE-2008-0527 on Cisco devices?

The impact of CVE-2008-0527 on Cisco devices includes potential remote denial of service, causing the phones to reboot.

Is there a workaround for CVE-2008-0527?

Currently, the best workaround for CVE-2008-0527 is to ensure that your devices are isolated from untrusted networks until a firmware update is applied.