Cisco Patches Potentially Crippling VoIP Flaws
Cisco late Wednesday patched seven severe vulnerabilities in its widely used internet telephony software that could permit device compromise or system shutdown.
The bugs – rated “highly critical” by vulnerability tracking firm Secunia – were reported in 16 devices from the networking giant’s Unified IP Phone 7900 series, according to a Cisco advisory. Affected phones are those running either the industry standard session initiation protocol (SIP) and/or Cisco’s proprietary Skinny Client Control Protocol (SCCP).
Four of the VoIP flaws are overflow vulnerabilities, caused by handling errors that could result in the installation of malicious code on a victim’s phone. Another two bugs could permit specially crafted packets to launch DoS attacks. And a final vulnerability may allow privilege escalation.
Read more about this at SC Magazine.