Cisco issues multiple unified communications security alerts

Cisco Wednesday issued two separate security alerts concerning its unified communications products - the third UC-related alert of this year. One of the alerts issued this week concern flaws in Cisco's Unified IP Phone (compare IP phones) models, specifically related to the company's Skinny Call Control Protocol (SCCP, or "Skinny") and Session Initiation Protocol (SIP), while the other relates to an SQL Injection attack that could affect Cisco's Unified Communications Manager - formerly CallManager. 

According to Cisco, a number of its IP phones contain multiple overflow and denial-of-service vulnerabilities. Certain phones running SCCP and/or SIP firmware are vulnerable (see the list at the Cisco advisory). SCCP- and SIP-based phones contain a buffer overflow vulnerability in the handling of DNS responses. A specially-crafted DNS response may be able to trigger a buffer overflow and execute arbitrary code on a vulnerable phone, says Cisco. The hole is fixed in SCCP firmware version 8.0(8) and SIP firmware version 8.8(0).

Cisco outlined three vulnerablities that affect certain SCCP devices: a large Internet Control Message Protocol (ICMP) Echo Request DOS, which can cause a vulnerable device to reboot by sending a large ICMP echo request packet; an HTTP Server DOS problem that could cause certain phones to reboot by sending a specially crafted HTTP request to TCP port 80; and a Secure Shell (SSH) flaw in other Cisco phones that could cause the phones to reboot if an unauthenticated attacker sent a specially crafted packet to port 22.

There are also three vulnerabilities affecting Cisco's SIP devices: a SIP Multipurpose Internet Mail Extensions (MIME) boundary overflow; a Telnet Server overflow, and a SIP Proxy Response overflow.

The company also warned that its Unified Communications Manager is vulnerable to an SQL Injection attack in the parameter key of the admin and user interface pages. A successful attack could allow an authenticated attacker to access information such as usernames and password hashes that are stored in the database, according to this Cisco advisory. Cisco has released free software updates that address this vulnerability.

In January, Cisco warned that its Cisco Unified Communications Manager contains a heap overflow vulnerability in the Certificate Trust List that could allow a hacker to cause a denial-of-service attack or execute arbitrary code.

Check out Cisco products in Network World's Buyers' Guides.

More from Cisco Subnet:

* Is Cisco preparing for layoffs?

* Cracking Cisco LEAP video coming up

* Cisco ACE vs. F5 LTM

* SMB switch market - is Cisco totally clueless?

 * A CCIE job that only offers $150K - ummm...maybe...well...no.....

* Cisco and Apple: Time for a hug

* Now Juniper's planning a Cisco MARS attack

* Vote for your favorite Juniper lampoon of Cisco peccadillo

* 10 wishes for router security

* Cisco marries Google Android with unified communications for the enterprise 

* Cisco lawsuit illustrates the murky world of patent litigation

* Understanding MPLS VPNs

* Building your own CCNA lab series

* Win a Nintendo Wii; win a copy of 'Router Security Strategies: Securing IP Network Traffic Planes ' book

Go to Cisco Subnet for more Cisco news, blogs, discussion forums, security alerts, book giveaways, and more.

Recent Cisconet blog entries

Network World's IT Buyer's Guide: Cisco products

Subscribe to Network World's Cisco Alert, which includes a weekly digest of all Cisco Subnet items