A vulnerability has been reported in Grandstream BudgeTone 200 SIP Phone, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error within the processing of "WWW-Authenticate" headers in SIP messages. This can be exploited to cause the device to crash via a SIP message (e.g. INVITE or CANCEL) containing a "WWW-Authenticate" header with a specially crafted "Digest domain" attribute.

The vulnerability is reported in devices with firmware version 1.1.1.14. Other versions may also be affected.

Solution
Use another product.

Provided and/or discovered by
Humberto J. Abdelnur, Radu State, and Olivier Festor

Changelog
Further details available in Customer Area

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2007-March/053099.html

Deep Links
Links available in Customer Area