ID CVE-2008-3799
Summary Memory leak in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service (memory consumption and voice-service outage) via unspecified valid SIP messages.
References
Vulnerable Configurations
  • cpe:2.3:o:cisco:ios:12.3:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios:12.3:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios:12.4:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios:12.4:*:*:*:*:*:*:*
  • cpe:2.3:o:cisco:ios:12.2:*:*:*:*:*:*:*
    cpe:2.3:o:cisco:ios:12.2:*:*:*:*:*:*:*
CVSS
Base: 7.8 (as of 02-06-2022 - 17:10)
Impact:
Exploitability:
CWE CWE-772
CAPEC
  • HTTP DoS
    An attacker performs flooding at the HTTP level to bring down only a particular web application rather than anything listening on a TCP/IP connection. This denial of service attack requires substantially fewer packets to be sent which makes DoS harder to detect. This is an equivalent of SYN flood in HTTP. The idea is to keep the HTTP session alive indefinitely and then repeat that hundreds of times. This attack targets resource depletion weaknesses in web server software. The web server will wait to attacker's responses on the initiated HTTP sessions while the connection threads are being exhausted.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE COMPLETE
cvss-vector via4 AV:N/AC:L/Au:N/C:N/I:N/A:C
oval via4
accepted 2010-08-02T04:00:08.918-04:00
class vulnerability
contributors
  • name Yuzheng Zhou
    organization Hewlett-Packard
  • name KASHIF LATIF
    organization DTCC
description Memory leak in the Session Initiation Protocol (SIP) implementation in Cisco IOS 12.2 through 12.4, when VoIP is configured, allows remote attackers to cause a denial of service (memory consumption and voice-service outage) via unspecified valid SIP messages.
family ios
id oval:org.mitre.oval:def:5927
status accepted
submitted 2008-09-24T11:06:36.000-04:00
title Cisco IOS Session Initiation Protocol Denial of Service Vulnerability
version 8
refmap via4
cisco 20080924 Multiple Cisco IOS Session Initiation Protocol Denial of Service Vulnerabilities
sectrack 1020939
secunia 31990
vupen ADV-2008-2670
Last major update 02-06-2022 - 17:10
Published 26-09-2008 - 16:21
Last modified 02-06-2022 - 17:10
Back to Top