The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Cisco Unified IP Phone

security threat CVE-2018-0316

Cisco Unified IP Phone: denial of service via Multiplatform Firmware SIP

Synthesis of the vulnerability

An attacker can generate a fatal error via Multiplatform Firmware SIP of Cisco Unified IP Phone, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 07/06/2018.
Identifiers: CERTFR-2018-AVI-270, cisco-sa-20180606-multiplatform-sip, CSCvi24718, CVE-2018-0316, VIGILANCE-VUL-26345.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via Multiplatform Firmware SIP of Cisco Unified IP Phone, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

threat CVE-2018-0332

Cisco Unified IP Phone: denial of service via SIP INVITE

Synthesis of the vulnerability

An attacker can generate a fatal error via SIP INVITE of Cisco Unified IP Phone, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 07/06/2018.
Identifiers: CERTFR-2018-AVI-270, cisco-sa-20180606-ip-phone-dos, CVE-2018-0332, VIGILANCE-VUL-26344.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via SIP INVITE of Cisco Unified IP Phone, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

weakness CVE-2018-0325

Cisco IP Phone 7800/8800/8821: denial of service via SIP SDP

Synthesis of the vulnerability

An attacker can generate a fatal error via SIP SDP of Cisco IP Phone 7800/8800/8821, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 17/05/2018.
Identifiers: CERTFR-2018-AVI-240, cisco-sa-20180516-ip-phone-dos, CSCvf40066, CSCvj73508, CVE-2018-0325, VIGILANCE-VUL-26155.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via SIP SDP of Cisco IP Phone 7800/8800/8821, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer threat note CVE-2017-12328

Cisco IP Phone 8800: denial of service via SIP

Synthesis of the vulnerability

An attacker can send malicious SIP packets to Cisco IP Phone 8800, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 30/11/2017.
Identifiers: cisco-sa-20171129-ipp, CSCvc62590, CVE-2017-12328, VIGILANCE-VUL-24580.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can send malicious SIP packets to Cisco IP Phone 8800, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

security note CVE-2017-12305

Cisco IP Phone 8800 Series: code execution via Debug Shell

Synthesis of the vulnerability

An attacker can use a vulnerability via Debug Shell of Cisco IP Phone 8800 Series, in order to run code.
Severity: 2/4.
Creation date: 16/11/2017.
Identifiers: cisco-sa-20171115-ipp, CSCvf80034, CVE-2017-12305, VIGILANCE-VUL-24474.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can use a vulnerability via Debug Shell of Cisco IP Phone 8800 Series, in order to run code.
Full Vigil@nce bulletin... (Free trial)

threat CVE-2017-13077 CVE-2017-13078 CVE-2017-13079

WPA2: information disclosure via Key Reinstallation Attacks

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via Key Reinstallation Attacks of WPA2, in order to obtain sensitive information.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 10.
Creation date: 16/10/2017.
Identifiers: ARUBA-PSA-2017-007, CERTFR-2017-ALE-014, CERTFR-2017-AVI-357, CERTFR-2017-AVI-358, CERTFR-2017-AVI-359, CERTFR-2017-AVI-360, CERTFR-2017-AVI-361, CERTFR-2017-AVI-363, CERTFR-2017-AVI-373, CERTFR-2017-AVI-379, CERTFR-2017-AVI-383, CERTFR-2017-AVI-390, CERTFR-2017-AVI-441, CERTFR-2017-AVI-478, CERTFR-2018-AVI-014, CERTFR-2018-AVI-048, cisco-sa-20171016-wpa, CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13084, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088, DLA-1150-1, DLA-1200-1, DLA-1573-1, DSA-3999-1, FEDORA-2017-12e76e8364, FEDORA-2017-45044b6b33, FEDORA-2017-60bfb576b7, FEDORA-2017-cfb950d8f4, FEDORA-2017-fc21e3856b, FG-IR-17-196, FreeBSD-SA-17:07.wpa, HT208221, HT208222, HT208334, HT208394, JSA10827, K-511282, KRACK Attacks, openSUSE-SU-2017:2755-1, openSUSE-SU-2017:2846-1, openSUSE-SU-2017:2896-1, openSUSE-SU-2017:2905-1, openSUSE-SU-2017:3144-1, RHSA-2017:2907-01, RHSA-2017:2911-01, SSA:2017-291-02, SSA-418456, SSA-901333, STORM-2017-005, SUSE-SU-2017:2745-1, SUSE-SU-2017:2752-1, SUSE-SU-2017:2847-1, SUSE-SU-2017:2869-1, SUSE-SU-2017:2908-1, SUSE-SU-2017:2920-1, SUSE-SU-2017:3106-1, SUSE-SU-2017:3165-1, SUSE-SU-2017:3265-1, SUSE-SU-2017:3267-1, SUSE-SU-2018:0040-1, SUSE-SU-2018:0171-1, Synology-SA-17:60, Synology-SA-17:60 KRACK, USN-3455-1, USN-3505-1, VIGILANCE-VUL-24144, VU#228519.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass access restrictions to data via Key Reinstallation Attacks of WPA2, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

threat note CVE-2017-6630

Cisco IP Phone 8851: denial of service via SIP CANCEL

Synthesis of the vulnerability

An attacker can send malicious SIP CANCEL packets to Cisco IP Phone 8851, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 18/05/2017.
Identifiers: CERTFR-2017-AVI-160, cisco-sa-20170517-sip, CSCvc34795, CVE-2017-6630, VIGILANCE-VUL-22760.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The Cisco IP Phone 8851 product has a service to manage received SIP CANCEL packets.

However, when malicious SIP CANCEL packets are received, a fatal error occurs.

An attacker can therefore send malicious SIP CANCEL packets to Cisco IP Phone 8851, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer weakness CVE-2016-7053 CVE-2016-7054 CVE-2016-7055

OpenSSL 1.1: three vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of OpenSSL 1.1.
Severity: 2/4.
Number of vulnerabilities in this bulletin: 3.
Creation date: 10/11/2016.
Revision date: 13/12/2016.
Identifiers: 2004036, 2004940, 2011567, 492284, 492616, bulletinapr2017, CERTFR-2018-AVI-343, cisco-sa-20161114-openssl, cpuapr2019, cpujan2018, cpujul2017, CVE-2016-7053, CVE-2016-7054, CVE-2016-7055, ESA-2016-148, ESA-2016-149, FG-IR-17-019, JSA10775, NTAP-20170127-0001, NTAP-20170310-0002, NTAP-20180201-0001, openSUSE-SU-2017:0527-1, openSUSE-SU-2017:0941-1, openSUSE-SU-2018:0458-1, SA40423, VIGILANCE-VUL-21093.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in OpenSSL 1.1.

An attacker can generate a buffer overflow via ChaCha20/Poly1305, in order to trigger a denial of service. [severity:2/4; CVE-2016-7054]

An attacker can force a NULL pointer to be dereferenced via CMS Structures, in order to trigger a denial of service. [severity:2/4; CVE-2016-7053]

An error occurs in the Broadwell-specific Montgomery Multiplication Procedure, but with no apparent impact. [severity:1/4; CVE-2016-7055]
Full Vigil@nce bulletin... (Free trial)

security alert CVE-2016-7052

OpenSSL 1.0.2i: NULL pointer dereference via CRL

Synthesis of the vulnerability

An attacker can force a NULL pointer to be dereferenced via a CRL on an application linked to OpenSSL 1.0.2i, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 26/09/2016.
Identifiers: 1996096, 2000095, 2000209, 2003480, 2003620, 2003673, 2008828, CERTFR-2016-AVI-333, cisco-sa-20160927-openssl, cpuapr2017, cpujan2018, cpuoct2017, CVE-2016-7052, FEDORA-2016-97454404fe, FEDORA-2016-a555159613, FreeBSD-SA-16:27.openssl, HPESBHF03856, JSA10759, openSUSE-SU-2016:2496-1, openSUSE-SU-2018:0458-1, SA132, SB10171, SP-CAAAPUE, SPL-129207, SSA:2016-270-01, SUSE-SU-2016:2470-1, SUSE-SU-2016:2470-2, TNS-2016-16, VIGILANCE-VUL-20701.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The OpenSSL version 1.0.2i product fixed a bug in CRL management.

However, this fix does not check if a pointer is NULL, before using it.

An attacker can therefore force a NULL pointer to be dereferenced via a CRL on an application linked to OpenSSL 1.0.2i, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

vulnerability note CVE-2016-6309

OpenSSL 1.1.0a: use after free via TLS

Synthesis of the vulnerability

An attacker can force the usage of a freed memory area via TLS on an application linked to OpenSSL 1.1.0a, in order to trigger a denial of service, and possibly to run code.
Severity: 3/4.
Creation date: 26/09/2016.
Identifiers: 1996096, 2000095, 2000209, 2003480, 2003620, 2003673, 2008828, CERTFR-2016-AVI-333, cisco-sa-20160927-openssl, cpuapr2017, cpujan2018, CVE-2016-6309, HPESBHF03856, JSA10759, SA132, TNS-2016-16, VIGILANCE-VUL-20700.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The OpenSSL version 1.1.0a product fixed the CVE-2016-6307 vulnerability.

However, the reception of a TLS message of 16kb frees a memory area before reusing it.

An attacker can therefore force the usage of a freed memory area via TLS on an application linked to OpenSSL 1.1.0a, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Cisco Unified IP Phone: