Crash bug blights Cisco IP phones
Firmware flaw
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Cisco has advised users to update the firmware on some of its IP phones following the discovery of two security flaws.
A brace of Session Initiation Protocol (SIP) vulnerabilities in Cisco 7940/7960 IP Phones create the potential for hackers to crash - but not to run exploit code - on vulnerable handsets.
SIP is a signalling protocol for VoIP. The protocol can be used to create two-party, multiparty, or multicast sessions.
Cisco IP Phone 7940/7960 SIP firmware versions prior to 8.7(0) are vulnerable to the denial of service attacks, Cisco warns. Users are advised to update their firmware to version 8.7(0), as explained in its advisory here.
More detail on the vulnerabilities can be found in posts (here and here) to full disclosure mailing lists by the independent security researchers (Radu State, Humberto J Abdelnur, and Olivier Festor) who discovered the bugs. ®
COMMENTS
Perfectly happy
We've been using VoIP for about 4 years, largely cisco 7960 handsets.
Got to say that I'm really happy with the setup we have, it works really well.
Must check that all of our handsets are running the latest firmware version though, not aware of any crashing problems.
CTI popups and crappy quality
No, nobody I know is happy with the quality of VOIP audio, the way the quality degrades when network useage increases or the almost satellite like delays which randomly occur. As for the CTI software, forget it, it's more hassle than it's worth, epsecially with hotdesking.
Not Spin, just SIP
Unless I have totally mis-read the article and Cisco's release, they are not implying that you have to be hacking SIP. They are saying that the problem appears only on the SIP firmware load not the SCCP firmware load. Cisco would really prefer people using their VOIP phones to buy into the entire ecosystem of Call Managers, Unity VM, etc, and their SCCP signaling rather than the standards based SIP signaling. I have actually had more problems with Cisco phones rebooting due to moving the phone when the RJ-45 connection is not tight and loosing the PoE.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
