Cisco patches potentially crippling VoIP flaws

Share this article:
Cisco late Wednesday patched seven severe vulnerabilities in its widely used internet telephony software that could permit device compromise or system shutdown.

The bugs – rated “highly critical” by vulnerability tracking firm Secunia – were reported in 16 devices from the networking giant's Unified IP Phone 7900 series, according to a Cisco advisory. Affected phones are those running either the industry standard session initiation protocol (SIP) and/or Cisco's proprietary Skinny Client Control Protocol (SCCP).

Four of the VoIP flaws are overflow vulnerabilities, caused by handling errors that could result in the installation of malicious code on a victim's phone. Another two bugs could permit specially crafted packets to launch DoS attacks. And a final vulnerability may allow privilege escalation.

Dave Endler, director of security research at TippingPoint and author of Hacking Exposed: VoIP, told SCMagazineUS.com today that organizations can protect against these attacks with a defense-in-depth strategy.

That includes implementing a VoIP-aware firewall and intrusion prevention system, as well as separating voice and data onto separate virtual local area networks (VLANs), he said. If a business has those controls in place, insider access likely would be required to exploit the vulnerabilities.

While a widespread VoIP worm appears unlikely in the short term, Endler said more attacks will target internet telephony software going forward.

“More and more people are looking at VoIP now that it's getting more popular,” he said. “Just because you see more bugs doesn't mean it's getting less secure. The tools to discover these types of vulnerabilities are being more widely disseminated. There are many more free tools that anyone can download and run against these phones.”

Meanwhile, Cisco separately fixed a less critical vulnerability in its Unified Communications Manager.

The product, which provides call processing functionality for Cisco IP phones, is susceptible to a SQL injection attack that could grant authentication privileges, allowing attackers to steal information, such as usernames, password hashes and call records.
Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

Researcher hacks iPhone 6 Touch ID sensor

Little progress was made security wise, between the iPhone 5S and iPhone 6 sensor, a researcher found.

LEADS Act addresses gov't procedure for requesting data stored abroad

LEADS Act addresses gov't procedure for requesting data ...

Senators introduced the legislation last week as a means of amending the Electronic Communications Privacy Act (ECPA).

Report: Intrustion prevention systems made a comeback in 2013

Report: Intrustion prevention systems made a comeback in ...

A new report indicates that intrusion prevention systems grew 4.2 percent in 2013, with growth predicted to continue.