{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2002-07-12T00:00:00", "descriptions": [{"lang": "en", "value": "Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications via DNS spoofing."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2003-03-21T00:00:00", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp"}, {"name": "A071202-1", "tags": ["vendor-advisory", "x_refsource_ATSTAKE"], "url": "http://www.atstake.com/research/advisories/2002/a071202-1.txt"}, {"name": "5224", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/5224"}, {"name": "pingtel-xpressa-dns-spoofing(9566)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "http://www.iss.net/security_center/static/9566.php"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2002-0671", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications via DNS spoofing."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp", "refsource": "CONFIRM", "url": "http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp"}, {"name": "A071202-1", "refsource": "ATSTAKE", "url": "http://www.atstake.com/research/advisories/2002/a071202-1.txt"}, {"name": "5224", "refsource": "BID", "url": "http://www.securityfocus.com/bid/5224"}, {"name": "pingtel-xpressa-dns-spoofing(9566)", "refsource": "XF", "url": "http://www.iss.net/security_center/static/9566.php"}]}}}}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2002-0671", "datePublished": "2003-04-02T05:00:00", "dateReserved": "2002-07-09T00:00:00", "dateUpdated": "2003-03-21T00:00:00", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:pingtel:xpressa_firmware:1.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "8D73ABE8-8E28-4891-ACAF-576160B57D0A", "vulnerable": true}, {"criteria": "cpe:2.3:o:pingtel:xpressa_firmware:1.2.7.4:*:*:*:*:*:*:*", "matchCriteriaId": "39AA87AF-76F7-4B5C-ADD1-2A5211CBC78F", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:pingtel:xpressa:-:*:*:*:*:*:*:*", "matchCriteriaId": "534786F9-4EFA-40C5-89F9-3625563000CA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Pingtel xpressa SIP-based voice-over-IP phone 1.2.5 through 1.2.7.4 downloads phone applications from a web site but can not verify the integrity of the applications, which could allow remote attackers to install Trojan horse applications via DNS spoofing."}, {"lang": "es", "value": "La telefon\u00eda basada en voz sobre IP dePingtel xpressa SIP desde la versi\u00f3n 1.2.5 hasta la 1.2.7.4, descarga aplicaciones de telefon\u00eda de un sitio web, pero no verifica la integridad de dichas aplicaciones, lo cual podr\u00eda permitir a atacantes remotos la instalaci\u00f3n de caballos de troya mediante la falsificaci\u00f3n de la direcci\u00f3n IP origen de los paquetes (spoofing) en el DNS."}], "id": "CVE-2002-0671", "lastModified": "2024-02-03T02:32:50.030", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": true, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2002-07-23T04:00:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://www.atstake.com/research/advisories/2002/a071202-1.txt"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://www.iss.net/security_center/static/9566.php"}, {"source": "cve@mitre.org", "tags": ["Broken Link", "Vendor Advisory"], "url": "http://www.pingtel.com/PingtelAtStakeAdvisoryResponse.jsp"}, {"source": "cve@mitre.org", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/5224"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-494"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}