 |
 |
    |
Improper message parsing vulnerability in Nortel Networks PC Client may allow a remote attacker to crash the client
OverviewNortel Networks PC Client SIP phone may not parse a malformed SIP header value allowing a remote attacker to crash the phone by sending a SIP message with such malformed header to the phone ImpactNortel Networks PC Client crashes when trying to parse malformed header causing denial of service to the user. Sending such malformed message to multiple phones may have denial of service impact on a larger scale DescriptionNortel Networks PC Client is a PC-based user application that provides a multimedia communications features to users. Improper message parsing vulnerability exists in SIP header parsing module of Nortel Networks PC Client which may allow a remote attacker to crash the client. This results in a complete denial of service to the user. Sending such message to multiple users may results in denial of service to large number of users. If restarted, the phone does function normally. Solution
Phone SIP stack implementation should be patched to prevent exploiting such vulnerability. Vendor Response:Nortel is aware of Security Advisory VIPER-2007-045 as issued by the Sipera Systems VIPER lab team. We are actively investigating the details in this Advisory to confirm that our latest SIP phones are not susceptible to this vulnerability. A formal Nortel Security Bulletin addressing this Advisory is expected to be available by July 31st.
For more information on any of these threat advisories, please email Sipera VIPER Lab at viper@sipera.com |
Unified Communications Unleashed
Sipera Systems is the worldwide market leader in solutions for the rapid and simple adoption of Unified Communications (UC).
Thousands of users around the globe rely on Sipera to secure VoIP, IP video, collaboration, messaging and dozens of other high-performance applications.
Sipera’s groundbreaking “Borderless UC” enables controlled communications to any device in any location.
Years of UC Security experience is contained in Sipera unified communications (UC-Sec) products. These appliances benefit from the research conducted by Sipera VIPER Lab to provide comprehensive threat protection, policy enforcement, access control, and privacy in a single, real-time appliance.