search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Cisco IOS fails to properly handle Session Initiated Protocol packets

Vulnerability Note VU#438176

Original Release Date: 2007-01-31 | Last Revised: 2007-02-08


Cisco devices that run IOS and support voice traffic fail to properly handle Session Initiated Protocol packets. Exploitation of this vulnerability may result in a denial-of-service condition.


Cisco IOS is an operating system that is used on Cisco network devices. According to Cisco, "Session Initiation Protocol (SIP) is the Internet Engineering Task Force's (IETF's) standard for multimedia conferencing over IP. SIP is an ASCII-based, application-layer control protocol (defined in RFC 2543) that can be used to establish, maintain, and terminate calls between two or more end points." SIP typically operates on ports 5060/udp and 5060/tcp.

Cisco devices that run IOS and support voice traffic may have SIP enabled by default but not properly configured. Cisco devices with this configuration contain an unspecified vulnerability that may cause the device to reboot when a SIP packet is processed.

For more information, including a list of affected products and versions of IOS refer to Cisco Security Advisory: cisco-sa-20070131-sip.


A remote, unauthenticated attacker with the ability to send a specially crafted packet to an affected Cisco device may be able to cause that device to reboot. Sustained exploitation of this vulnerability may result in a denial-of-service. Because devices running IOS may transit traffic for a number of other networks, the secondary impacts of a denial of service may be severe.


Upgrade to an unaffected version of IOS
See the Software Version and Fixes section of Cisco Security Advisory: cisco-sa-20070131-sip for information on available upgrades.

Turn off SIP processing

Disabling SIP if it is not needed will prevent this vulnerability from being exploited. For instructions on how to turn off SIP processing, refer to the Workarounds section of Cisco Security Advisory cisco-sa-20070131-sip.

Restrict Access

Cisco does not have any examples of a properly configured SIP router being affected by this vulnerability. If you do not need SIP processed on your router, you can also restrict public access to SIP (udp 5060 and TCP 5060) on your router from the edge of your network.

Other workarounds and mitigation strategies can be found in the Cisco Applied Intelligence Response: Identifying and Mitigating Exploitation of the SIP Packet Reloads IOS Devices Not Configured for SIP Vulnerability document.

Vendor Information


Cisco Systems, Inc. Affected

Updated:  January 31, 2007



Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.


Refer to Cisco Security Advisory: cisco-sa-20070131-sip.

If you have feedback, comments, or additional information about this vulnerability, please send us email.

CVSS Metrics

Group Score Vector



This vulnerability was reported in Cisco Security Advisory: cisco-sa-20070131-sip.

This document was written by Jeff Gennari based on information from Cisco.

Other Information

CVE IDs: CVE-2007-0648
Severity Metric: 33.08
Date Public: 2007-01-31
Date First Published: 2007-01-31
Date Last Updated: 2007-02-08 19:06 UTC
Document Revision: 18

Sponsored by CISA.