CVE-2004-1940

CVE-2004-1940 describes a denial-of-service vulnerability in KPhone versions 4.0.1 and earlier, specifically within the sipclient.cpp component. Remote attackers can exploit this by sending a crafted STUN response packet containing an excessively large 'attrLen' value, leading to an out-of-bounds read and subsequently crashing the application. This vulnerability is rated with a CVSS score of 5.0, indicating a medium severity, as it can be exploited remotely with low attack complexity and without authentication, resulting in a denial of service. While there is no evidence of active exploitation, exploit code for this vulnerability is publicly available on ExploitDB, though it has garnered minimal community discussion or media coverage.