Signature Detail
Short Name |
VOIP:MGMT:XPRESSA-HTTP-DOS |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
VOIP |
Keywords |
Pingtel Xpressa Denial of Service |
Release Date |
2004/10/20 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
VOIP: Pingtel Xpressa Denial of Service
This signature detects attempts to exploit a known vulnerability in Pingtel Xpressa phones. Attackers can supply an overly long request to the HTTP management server on the phone to execute arbitrary code or crash the phone (the phone must be rebooted).
Extended Description
Pingtel Xpressa handsets are reported prone to a remote denial of service vulnerability. The issue is reported to exist because of a lack of sufficient boundary checks performed on HTTP request data handled by the Xpressa administration web server. It is reported that a remote attacker may exploit this vulnerability to effectively deny service to the affected handset. Due to the nature of this vulnerability, it is reported that this issue may be exploited in order to execute arbitrary code.
Affected Products
- Pingtel Xpressa 1.2.5
- Pingtel Xpressa 1.2.7 .4
- Pingtel Xpressa 1.2.8
- Pingtel Xpressa 2.0.0
- Pingtel Xpressa 2.0.1
- Pingtel Xpressa 2.1.11 .24
References
- BugTraq: 11161
- CVE: CVE-2004-1680
- URL: http://xforce.iss.net/xforce/xfdb/17346
- URL: http://www.securityfocus.com/archive/1/375054