Re: [FD] Snom SIP phones denial of service through HTTP

2015-01-13 Thread kape...@googlemail.com
The latest version is 8.7.3.25.9, there is no 8.7.4.X, yet. And yes, you missed something, (without the quotes) --data-binary @- This turns it into a HTTP POST request and uses the input from stdin. Otherwise you just do a regular HTTP GET which gets blocked because it's not authenticated. On

[FD] Snom SIP phones denial of service through HTTP

2015-01-12 Thread kape...@googlemail.com
Snom SIP phones (www.snom.com) have a builtin HTTP/HTTPS configuration interface, which is enabled by default. By making a single HTTP POST request all available memory (and CPU) can be exhausted, resulting in a reboot of the phone. This even works if the HTTP/HTTPS interface is protected by

Re: [FD] Snom SIP phones denial of service through HTTP

2015-01-12 Thread Martin Schuhmacher
Hi i just did $ dd if=/dev/zero bs=1M count=32 | curl http://$IP/ Response: Unauthorized request did i miss anything? Firmware: snom360-SIP 8.7.4.8 not downloadable any more for some reason? Yours Martin ___ Sent through the Full Disclosure