CVE-2002-0671

Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications via DNS spoofing.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.atstake.com/research/advisories/2002/a071202-1.txt	Broken Link
http://www.iss.net/security_center/static/9566.php	Broken Link
http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp	Broken Link Vendor Advisory
http://www.securityfocus.com/bid/5224	Broken Link Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:pingtel:xpressa_firmware:1.2.5:::::::*
	cpe:2.3:o:pingtel:xpressa_firmware:1.2.7.4:::::::*

cpe:2.3:h:pingtel:xpressa:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2002-07-23 04:00

Updated : 2024-02-03 02:32

NVD link : CVE-2002-0671

Mitre link : CVE-2002-0671

CVE.ORG link : CVE-2002-0671

JSON object : View

Products Affected

pingtel

xpressa_firmware
xpressa

CWE

CWE-494

Download of Code Without Integrity Check

{"id": "CVE-2002-0671", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": true, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2002-07-23T04:00:00.000", "references": [{"url": "http://www.atstake.com/research/advisories/2002/a071202-1.txt", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "http://www.iss.net/security_center/static/9566.php", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp", "tags": ["Broken Link", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/5224", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-494"}]}], "descriptions": [{"lang": "en", "value": "Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications via DNS spoofing."}, {"lang": "es", "value": "La telefon\u00eda basada en voz sobre IP dePingtel xpressa SIP desde la versi\u00f3n 1.2.5 hasta la 1.2.7.4, descarga aplicaciones de telefon\u00eda de un sitio web, pero no verifica la integridad de dichas aplicaciones, lo cual podr\u00eda permitir a atacantes remotos la instalaci\u00f3n de caballos de troya mediante la falsificaci\u00f3n de la direcci\u00f3n IP origen de los paquetes (spoofing) en el DNS."}], "lastModified": "2024-02-03T02:32:50.030", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:pingtel:xpressa_firmware:1.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D73ABE8-8E28-4891-ACAF-576160B57D0A"}, {"criteria": "cpe:2.3:o:pingtel:xpressa_firmware:1.2.7.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39AA87AF-76F7-4B5C-ADD1-2A5211CBC78F"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:pingtel:xpressa:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "534786F9-4EFA-40C5-89F9-3625563000CA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}