CVE:CVE-2007-0648
CNNVD:CNNVD-200701-564
Cisco IOS是Cisco网络设备所使用的操作系统。
运行某些IOS版本且支持SIP服务的Cisco设备中存在漏洞，可能允许通过向TCP 5060端口或UDP 5060端口发送一系列特制的SIP报文导致设备重载。此外，即使没有配置SIP操作的话，某些支持SIP服务的IOS版本也可能处理SIP消息。如果要处理SIP消息IOS需要打开UDP 5060端口和TCP 5060端口进行监听。设备必须有开放的SIP端口才会受这个漏洞影响。没有监听TCP 5060或UDP 5060的设备不受漏洞影响。由于SIP使用UDP进行传输，因此可以伪造发送者的IP地址，这可能导致允许从可信任IP地址到这些端口通讯的ACL失效。
solution:Upgrade cisco ios to a higher version than 12.3(14t,12.3(14t2,12.3(14t4,12.3(14t5,12.3yg,12.3yk,12.3ym,12.3yq,12.3yt,12.3yu,12.3yx,12.4,12.4(1,12.4(1b,12.4(1c,12.4(2mr,12.4(2mr1,12.4(2t,12.4(2t1,12.4(2t2,12.4(2t3,12.4(2t4,12.4(2xa,12.4(2xb,12.4(2xb2,12.4(3,12.4(3t2,12.4(3a,12.4(3b,12.4(3d,12.4(4mr,12.4(4t,12.4(4t2,12.4(5,12.4(5b,12.4(6t,12.4(6t1,12.4(7,12.4(7a,12.4(8,12.4(9t,12.4mr,12.4sw,12.4t,12.4xa,12.4xb,12.4xc,12.4xd,12.4xe,12.4xg,12.4xj,12.4xp,12.4xt,and avoid the version 12.3(14)t,12.3(14)t2,12.3(14)t4,12.3(14)t5,12.3yg,12.3yk,12.3ym,12.3yq,12.3yt,12.3yu,12.3yx,12.4,12.4(1),12.4(1b),12.4(1c),12.4(2)mr,12.4(2)mr1,12.4(2)t,12.4(2)t1,12.4(2)t2,12.4(2)t3,12.4(2)t4,12.4(2)xa,12.4(2)xb,12.4(2)xb2,12.4(3),12.4(3)t2,12.4(3a),12.4(3b),12.4(3d),12.4(4)mr,12.4(4)t,12.4(4)t2,12.4(5),12.4(5b),12.4(6)t,12.4(6)t1,12.4(7),12.4(7a),12.4(8),12.4(9)t,12.4mr,12.4sw,12.4t,12.4xa,12.4xb,12.4xc,12.4xd,12.4xe,12.4xg,12.4xj,12.4xp,12.4xt