|
 |
|
Succession Communication Server 2000 SIP Vulnerabilities
|
|
|
|
|
Secunia Advisory:
|
SA8121
|
|
|
Release Date:
|
2003-02-24
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| OS: | Succession Communication Server 2000
|
|
|
|
This advisory is currently marked as unpatched!
- Companies can be alerted when a patch is released! |
|
|
Description:
Nortel Networks has confirmed vulnerabilities in the SIP (Session Initiation Protocol) implementation in their Succession Communication Server 2000 and the Compact version.
The vulnerabilities have been identified in the INVITE message used by two SIP-endpoints during the initial call setup. The impact of successful exploitation of the vulnerabilities has not been disclosed but could potentially result in a compromise of a vulnerable device.
Products are only vulnerable when SIP-T (Session Initiation Protocol for Telephones) has been provisioned on the Communication Server.
Solution:
Nortel Networks are currently working on producing a patch.
As a temporary workaround SIP-T can be disabled. If this is not a viable solution because conversion from PSTN to SIP is required, outbound traffic as well as inbound traffic to broadcast addresses and the following ports should be filtered on the devices, firewalls and border routers:
5060/udp # Session Initiation Protocol (SIP)
5060/tcp # Session Initiation Protocol (SIP)
5061/tcp # Session Initiation Protocol (SIP) over TLS
Provided and/or discovered by:
Oulu University Secure Programming Group
Original Advisory:
http://www.kb.cert.org/vuls/id/528719
Other References:
http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/sip/
|
|
|
|
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
|
|
|
Send Feedback to Secunia
|
|
If you have new information regarding this Secunia advisory or a product in our database, please send it to us using either our web form or email us at vuln@secunia.com.
Ideas, suggestions, and other feedback are most welcome.
|
|
|
|
|
|
Secunia PSI
Scan | Patch | Track
Free Download
|
|
|
Secunia Poll
|
|
|
|
|
 |
|
|
Most Popular Advisories
|
|
|
|
|
|
