full-disclosure - (0-Day) GrandStream GXP-2000 VoIP Desktop Phone multiple undocumented UDP ports and DoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2592.68.240.249.117.1160007064.squirrel@webmail.io.com>
Date: Wed, 4 Oct 2006 19:11:04 -0500 (CDT)
From: shawnmer@...com
To: full-disclosure@...ts.grok.org.uk
Subject: (0-Day) GrandStream GXP-2000 VoIP Desktop Phone
 multiple undocumented UDP ports and DoS

Title:  GrandStream GXP-2000 VoIP Desktop Phone multiple undocumented UDP
ports and DoS

Version: 1.1.0.5

Issues:

1.The phone has multiple undocumented open UDP ports, including 5062,
5064, 5066, 9876, 26789
2.Sending large amount of ascii data via NetCat to any open UDP port,
including UDP/5060, results in the phone either rebooting or placed in a
frozen state, possibly appearing normal (display maintains text, etc.),
except the phone will not be functional.

Credit:

Shawn Merdinger, Independent Security Researcher

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/