中文描述:

Cisco IP Phone 8800 Series和Cisco IP Phone 7800 Series都是美国思科（Cisco）公司的产品。Cisco IP Phone 8800 Series是一款8800系列的IP电话。Cisco IP Phone 7800 Series是一款7800系列IP电话。Session Initiation Protocol（SIP）Software是其中的一款会话发起协议软件。 Cisco IP Phone 7800 Series和Cisco IP Phone 8800 Series中的SIP软件的基于Web的管理界面存在输入验证漏洞，该漏洞源于在进行身份验证时，程序没有正确地验证用户提交的输入。远程攻击者可通过使用HTTP协议连接到受影响的设备并提交恶意的用户凭证利用该漏洞重新加载受影响的设备，导致拒绝服务或以应用程序用户的权限执行任意代码。以下产品受到影响：Cisco Unified IP Conference Phone 8831（SIP软件10.3(1)SR5）；Wireless IP Phone 8821（SIP软件11.0(4)SR3版本）；Wireless IP Phone 8821-EX（SIP软件11.0(4)SR3版本）；其他IP Phone 7800系列产品（SIP软件12.5(1)SR1版本）；其他IP Phone 8800系列产品（SIP软件12.5(1)SR1版本）。

英文描述:

A vulnerability in the web-based management interface of Session Initiation Protocol (SIP) Software for Cisco IP Phone 7800 Series and Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition or execute arbitrary code. The vulnerability exists because the software improperly validates user-supplied input during user authentication. An attacker could exploit this vulnerability by connecting to an affected device using HTTP and supplying malicious user credentials. A successful exploit could allow the attacker to trigger a reload of an affected device, resulting in a DoS condition, or to execute arbitrary code with the privileges of the app user. Cisco fixed this vulnerability in the following SIP Software releases: 10.3(1)SR5 and later for Cisco Unified IP Conference Phone 8831; 11.0(4)SR3 and later for Cisco Wireless IP Phone 8821 and 8821-EX; and 12.5(1)SR1 and later for the rest of the Cisco IP Phone 7800 Series and 8800 Series.

CWE类型:

标签:

中文解决方案:

英文解决方案:

临时解决方案:

发布时间:

修改时间:

创建时间:

更新时间:

当前版本: v3

主要语言: EN

支持语言: