|
Succession Communication Server 2000 SIP Vulnerabilities
|
|
Secunia Advisory:
|
SA8121
|
|
|
Release Date:
|
2003-02-24
|
|
Popularity:
|
5,293 views
|
|
|
Critical:
|
Highly critical
|
|
Impact:
|
DoS
System access
|
|
Where:
|
From remote
|
|
Solution Status:
|
Unpatched
|
|
| OS: | Succession Communication Server 2000
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
Description:
Nortel Networks has confirmed vulnerabilities in the SIP (Session Initiation Protocol) implementation in their Succession Communication Server 2000 and the Compact version.
The vulnerabilities have been identified in the INVITE message used by two SIP-endpoints during the initial call setup. The impact of successful exploitation of the vulnerabilities has not been disclosed but could potentially result in a compromise of a vulnerable device.
Products are only vulnerable when SIP-T (Session Initiation Protocol for Telephones) has been provisioned on the Communication Server.
Solution:
Nortel Networks are currently working on producing a patch.
As a temporary workaround SIP-T can be disabled. If this is not a viable solution because conversion from PSTN to SIP is required, outbound traffic as well as inbound traffic to broadcast addresses and the following ports should be filtered on the devices, firewalls and border routers:
5060/udp # Session Initiation Protocol (SIP)
5060/tcp # Session Initiation Protocol (SIP)
5061/tcp # Session Initiation Protocol (SIP) over TLS
Provided and/or discovered by:
Oulu University Secure Programming Group
Original Advisory:
http://www.kb.cert.org/vuls/id/528719
Other References:
http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/sip/
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
