CVE-2008-0531: Buffer Overflow

Published Feb 15, 2008

Updated

Heap-based buffer overflow in Cisco Unified IP Phone 7940, 7940G, 7960, and 7960G running SIP firmware might allow remote SIP servers to execute arbitrary code via a crafted challenge/response message.

Affected Software

14 affected components

Cisco Unified IP Phone=7906g

Cisco Unified IP Phone=7911g

Cisco Unified IP Phone=7935

Cisco Unified IP Phone=7936

Cisco Unified IP Phone=7940

Cisco Unified IP Phone=7940g

Cisco Unified IP Phone=7941g

Cisco Unified IP Phone=7960

Cisco Unified IP Phone=7960g

Cisco Unified IP Phone=7961g

Cisco Unified IP Phone=7970g

Cisco Unified IP Phone=7971g

Cisco Skinny Client Control Protocol \(sccp\) Firmware

Cisco Session Initiation Protocol \(sip\) Firmware

Remediation

Patch Available

http://www.cisco.com/en/US/products/products_security_advisory09186a0080949c7a.shtml

Event History

Feb 15, 2008

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Data Sourced

02:00 AM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-0531?

CVE-2008-0531 is classified as a high severity vulnerability due to the potential for remote code execution.

How do I fix CVE-2008-0531?

To remediate CVE-2008-0531, update the affected Cisco Unified IP Phones to a version that is not vulnerable to this issue.

What types of devices are affected by CVE-2008-0531?

CVE-2008-0531 affects Cisco Unified IP Phones, specifically models 7940, 7940G, 7960, and 7960G running vulnerable SIP firmware.

Can CVE-2008-0531 be exploited remotely?

Yes, CVE-2008-0531 can be exploited remotely through crafted challenge/response messages sent from a malicious SIP server.

What are the consequences of exploiting CVE-2008-0531?

Exploitation of CVE-2008-0531 may allow an attacker to execute arbitrary code on the affected IP phone, compromising the device's security.