https://www.exploit-db.com/exploits/22060
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200212-608

3ComSuperstack3NBXIP电话系统使用嵌入式实时操作系统(EROTS)，其中包含FTPD守护程序。EROTS操作系统的FTPD程序对超长CEL参数缺少正确处理，远程攻击者可以利用这个漏洞对IP电话系统进行拒绝服务攻击。攻击者可以向远程EROTS操作系统的FTPD程序发送参数超过2048字节长的CEL命令，可导致FTP服务程序崩溃，而且各种VoIP服务如基于WEB管理控制台、控制系统、进出电话都停止响应。目前未知是否可以利用这个漏洞执行任意代码。

source: http://www.securityfocus.com/bid/6297/info

It has been reported that the ftpd server, included in the Embedded Real Time Operating System (ERTOS) of 3Com Superstack 3 NBX IP phones, contains a denial of service vulnerability. This issue can be triggered by sending a CEL paramater of excessive length, effectively causing the ftpd server and various VoIP services to no longer respond.

It should be noted that this issue may be similar to the vulnerability described in BID 679.

Although unconfirmed, it should also be noted that due to the nature of this vulnerability under some circumstances it may be exploited to execute arbitrary code.

CEL aaaa[...]aaaa where string is 2048 bytes long

来源:XF
名称:3com-nbx-cel-bo(10739)
链接:http://xforce.iss.net/xforce/xfdb/10739
来源:BID
名称:6297
链接:http://www.securityfocus.com/bid/6297
来源:www.secnap.com
链接:http://www.secnap.com/alerts.php?pg=6
来源:SECTRACK
名称:1005732
链接:http://securitytracker.com/id?1005732
来源:BUGTRAQ
名称:200304273comNBXIPPhoneCallmanagerDenialofService-Update
链接:http://seclists.org/lists/bugtraq/2003/Apr/0344.html
来源:BUGTRAQ
名称:20021202[VU#317417]DenialofServiceconditioninvxworksftpd/3comnbx
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=103886644126011&w;=2
来源：NSFOCUS
名称：3962
链接：http://www.nsfocus.net/vulndb/3962