QwikSec

Security Database

CVE

CWE

Training

CVE-2007-3319

Published: Jun 21, 2007

Modified: Aug 7, 2024

PUBLISHED

Description

The Avaya 4602SW IP Phone (Model 4602D02A) with 2.2.2 and earlier SIP firmware does not use the cnonce parameter in the Authorization header of SIP requests during MD5 digest authentication, which allows remote attackers to conduct man-in-the-middle attacks and hijack or intercept communications.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://www.sipera.com/index.php?action=resources%2Cthreat_advisory&tid=299&

x_refsource_MISC

http://support.avaya.com/elmodocs2/security/ASA-2007-263.htm

x_refsource_CONFIRM

vdb-entry

x_refsource_OSVDB

avaya-cnonce-call-hijacking(34972)

vdb-entry

x_refsource_XF

third-party-advisory

x_refsource_SECUNIA

vdb-entry

x_refsource_BID

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.