CVE:CVE-2007-5638
CNNVD:CNNVD-200710-434
Nortel IP Phone、IP Softphone等都是Nortel所发布的IP电话设备。 
Nortel IP Phone实现上存在漏洞，远程攻击者可能利用此漏洞实现远程现场窃听。
如果用户发送了正确的UNIStim消息的话，就可能将IP电话置于监控模式。UNIStim消息ID必须匹配发送信号的服务器与IP电话之间的ID，但协议仅对ID数使用了16位长度。如果恶意用户发送了65536个穷尽了所有可能ID数的欺骗UNIStim消息的话，就可以打开音频通道，使IP电话的话筒处于远程监听的状态。
solution:Upgrade nortel business_communications_manager to a higher version than 50,50a,50e,200,400,1000,srg50,srg200,and avoid the version 50,50a,50e,200,400,1000,srg50,srg200; Upgrade nortel centrex_ip_client_manager to a higher version than *; Upgrade nortel centrex_ip_element_manager to a higher version than *; Upgrade nortel meridian_option_11c to a higher version than *; Upgrade nortel meridian_option_51c to a higher version than *; Upgrade nortel meridian_option_61c to a higher version than *; Upgrade nortel meridian_option_81c to a higher version than *; Upgrade nortel meridian_sl100 to a higher version than cs2100,and avoid the version cs2100; Upgrade nortel mobile_voice_client_2050 to a higher version than *