Signature Detail

HTTP: Localhost Host Header in Trans-Internet Request

This signature detects attempts to exploit a known vulnerability against several HTTP-based Web Interfaces for network devices (such as VOIP Phones). An attacker can send a crafted message to the server allowing them to bypass security restrictions and reconfigure or make arbitrary use of the device.

Extended Description

The web interface on snom VoIP phones is prone to an authentication-bypass vulnerability because it fails to properly verify HTTP requests. Successful exploits may allow attackers to bypass security restrictions and reconfigure the phones or make arbitrary use of the phones. snom VoIP phones with firmware prior to 6.5.20, 7.1.39 and 7.3.14 are vulnerable.

Affected Products

• Snom_technology snom300 6.5.17
• Snom_technology snom300 6.5.18
• Snom_technology snom300 7.1.30
• Snom_technology snom300 7.1.35
• Snom_technology snom320 6.5.17
• Snom_technology snom320 6.5.18
• Snom_technology snom320 7.1.30
• Snom_technology snom320 7.1.35
• Snom_technology snom_320_sip_phone 3.2.5 linux
• Snom_technology snom360_sip 6.5.17
• Snom_technology snom360_sip 6.5.18
• Snom_technology snom360_sip 7.1.30
• Snom_technology snom360_sip 7.1.35
• Snom_technology snom370 6.5.17
• Snom_technology snom370 6.5.18
• Snom_technology snom370 7.1.30
• Snom_technology snom370 7.1.35
• Snom_technology snom820 6.5.17
• Snom_technology snom820 6.5.18
• Snom_technology snom820 7.1.30
• Snom_technology snom820 7.1.35

References

• BugTraq: 43130
• CVE: CVE-2008-4008
• CVE: CVE-2009-1048
• URL: http://www.snom.com/en/home/
• URL: http://www.csnc.ch/misc/files/advisories/cve-2009-1048.txt