Information disclosure in Nortel Business Communications Manager
CVE-2007-5638
The Nortel UNIStim IP Softphone 2050, IP Phone 1140E, and additional Nortel products from the IP Phone, Business Communications Manager (BCM), and other product lines, use only 65536 different values in the 32-bit ID number field of an RUDP datagram, which makes it easier for remote attackers to guess the RUDP ID and spoof messages. NOTE: this can be leveraged for an eavesdropping attack by sending many Open Audio Stream messages.
Vulnerability class: Information Disclosure
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.015 (73.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 73.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Nortel Business Communications Manager — versions 50, 50a, 50e
- Nortel Centrex Ip Client Manager
- Nortel Centrex Ip Element Manager
- Nortel Communications Server — versions 1000e, 1000m, 1000s
- Nortel Ip Audio Conference Phone 2033
- Nortel Ip Phone 1110
- Nortel Ip Phone 1120e
- Nortel Ip Phone 1140e
- Nortel Ip Phone 1150e
- Nortel Ip Phone 2001
Weakness classification (CWE)
References
- exchange.xforce.ibmcloud.com/vulnerabilities/37255 (vdb-entry)
- secunia.com/advisories/27234 (Patch, Vendor Advisory, third-party-advisory)
- osvdb.org/41770 (vdb-entry)
- www.csnc.ch/static/advisory/csnc/nortel_IP_phone_surveillance_mode_v1.0.txt (Exploit)
- exchange.xforce.ibmcloud.com/vulnerabilities/42881 (vdb-entry)
- securityreason.com/securityalert/3272 (third-party-advisory)
- www.securityfocus.com/archive/1/482478/100/0/threaded (mailing-list)
- www.securityfocus.com/bid/26120 (Exploit, vdb-entry)