[Partysip-dev] Re: [Sipforum-discussion] CERT Alert re: SIP Security Issues

[Aymeric Moizard]

Following the link below, you'll find links to a
java application for testing SIP applications behaviors
for many different scenarios.

>From what I can see, this is mainly usefull for testing the
parser robustness against malformed or unusual messages.

I ran a lot of them against partysip and found 2 bugs
related to those messages within the code of partysip.

By now, I found no issue with oSIP... Great!

If you want to test the scenarios against partysip , at
least use the CVS!

Good testing day.
Aymeric

On Mon, 24 Feb 2003, Jeff Pulver wrote:

> Hi All,
>
> Over the weekend, I saw the following CERT Advisory, CA-2003-06, "Multiple
> vulnerabilities in implementations of the Session Initiation Protocol
> (SIP)" posted to: ( http://www.cert.org/advisories/CA-2003-06.html ).
>
> Just wanted to make sure everyone on the list was aware of this CERT
> Advisory.
>
>
> Best regards,
>
> Jeff Pulver
> http://pulver.com/fwd
>
>
>
>