HTTP: Cisco VoIP Phone Streaming Statistics Request

This signature detects attempts to exploit the small HTTP server included with Cisco VoIP phones. Versions CP-79xx are vulnerable. Attackers can review the statistical information served up by the StreamingStatistics script and use the information to perform attacks against the VoIP network.

Extended Description

The 7900 series VoIP Phones are a Voice-Over-IP solution distributed by Cisco Systems. It is possible to deny service to users of this line of phones. By placing a request to the /StreamingStatistics script with a stream ID (i.e. http://www.example.com/StreamingStatistics? where is an integer value) of arbitrarily high value, the phone will reset itself, creating the inability to place or receive calls for a period of up to thirty seconds. This has been reportedly reproduced by passing stream ID values of greater than 32768, and consistently reproduced with a value of 120000.

Affected Products

Cisco voip_phone_cp-7960

References

BugTraq: 4794

CVE: CVE-2002-0882

URL: http://online.securityfocus.com/archive/1/273673 http://online.securityfocus.com/advisories/4140

Short Name

HTTP:CISCO:VOIP:STREAM-ID-REQ

Severity

Info

Recommended

False

Recommended Action

None

HTTP: Cisco VoIP Phone Streaming Statistics Request

Extended Description

Affected Products

References

Found a potential security threat?