Cisco Systems said today that its Unified CallManager and Presence Server software contain a number of vulnerabilities that could permit DoS attacks.
In an advisory, the networking giant said CallManager versions 3.3, 4.1, 4.2 and 5.0, in addition to Presence Server version 1.0, are affected by the flaws.
The most severe of the five vulnerabilities rated 4.7 out of 10 on Cisco's vulnerability scoring system.
Currently there are no workarounds for the bugs, and the company is developing a permanent fix, which will be distributed when it becomes available, according to a Cisco advisory. In the meantime, users should filter traffic as described in the advisory.
Andrew Storms, director of security operations for nCircle, said the flaws are relatively easy to exploit and can result in a loss of telephone service for an enterprise.
"In one instance, simply sending a large number of [internet control message protocol] packets to a Cisco Unified CallManager can cause the system to crash," he said.
CallManager provides processing for Cisco's VoIP software solutions, while the Presence Server tracks the usage of those products.
Click here to email reporter Dan Kaplan.
Looking for a new job. SCMagazine.com has the latest IT security job opportunities. Click here for our Jobs page.
