CVE:CVE-2007-4459
CNNVD:CNNVD-200708-349
"Cisco 7940型IP电话是一种多功能通讯设备，通过IP网络传递语音信号。
Cisco 7940在处理特定的请求序列时存在漏洞，远程攻击者可能利用此漏洞导致设备不可用。
如果向Cisco 7940 IP电话发送了以下3个消息序列的话：
X ------------------------- INVITE -----------------------> Cisco
X <--- 481 transaction does not exists -----  Cisco
X ------------------------- OPTIONS--------------------> Cisco
X <--------------------------- OK -------------------------  Cisco
X <--- 481 transaction does not exists -----  Cisco
X ------------------------- OPTIONS--------------------> Cisco
或发送以下10个消息序列的话：
X ------------------------- INVITE -----------------------> Cisco
X <--------------- 400 Bad Request  ---------------  Cisco
X <--------------- 400 Bad Request  ---------------  Cisco
X <--------------- 400 Bad Request  ---------------  Cisco
X <--------------- 400 Bad Request  ---------------  Cisco
X <--------------- 400 Bad Request  ---------------  Cisco
X ------------------------- OPTIONS--------------------> Cisco
X <--------------------- 200 OK -------------------------  Cisco
X ------------------------- OPTIONS--------------------> Cisco
X <--------------------- 200 OK -------------------------  Cisco
X <--------------- 400 Bad Request  ---------------  Cisco
X ------------------------- INVITE -----------------------> Cisco
X <--------------- 400 Bad Request  ---------------  Cisco
X <--------------- 400 Bad Request  ---------------  Cisco
X ------------------------- OPTIONS--------------------> Cisco
X <--------------- 404 Not Found ------------------  Cisco
X <--------------- 400 Bad Request  ---------------  Cisco
X <--------------- 400 Bad Request  ---------------  Cisco
X <--------------- 400 Bad Request  ---------------  Cisco
X ------------------------- OPTIONS--------------------> Cisco
X <--------------------- 200 OK -------------------------  Cisco
X ------------------------- INVITE -----------------------> Cisco
X <----------------100 Trying  -------------------------  Cisco
X <--------------- 404 Not Found ------------------  Cisco
X <--------------- 404 Not Found ------------------  Cisco
X <--------------- 404 Not Found ------------------  Cisco
X ------------------------- OPTIONS--------------------> Cisco
X <--------------------- 200 OK -------------------------  Cisco
X <--------------- 404 Not Found ------------------  Cisco
X ------------------------- OPTIONS--------------------> Cisco
X <--------------------- 200 OK -------------------------  Cisco
X <--------------- 404 Not Found ------------------  Cisco
就会导致设备重启。
"
solution:Upgrade cisco voip_phone_cp-7940 to a higher version than *:p0s3-08-6-00_firmware,3.0:p0s3-08-6-00_firmware,3.1:p0s3-08-6-00_firmware,3.2:p0s3-08-6-00_firmware,8.6:p0s3-08-6-00_firmware,and avoid the version *:p0s3-08-6-00_firmware,3.0:p0s3-08-6-00_firmware,3.1:p0s3-08-6-00_firmware,3.2:p0s3-08-6-00_firmware,8.6:p0s3-08-6-00_firmware; Upgrade cisco voip_phone_cp-7960 to a higher version than *:p0s3-08-6-00_firmware,and avoid the version *:p0s3-08-6-00_firmware