Internet Telephony Product of the Year

Improper message parsing vulnerability in Nortel Networks PC Client may allow a remote attacker to crash the client

Advisory Number: VIPER-2007-045
Release Date: 2007.06.19
Source: Sipera VIPER Lab
Systems Affected: Nortel Networks PC Client SIP Soft Phone (release 4.1, version 3.5.208[20051015])
Category: Soft Phone Denial of Service
Severity: High

Overview

Nortel Networks PC Client SIP phone may not parse a malformed SIP header value allowing a remote attacker to crash the phone by sending a SIP message with such malformed header to the phone

Impact

Nortel Networks PC Client crashes when trying to parse malformed header causing denial of service to the user. Sending such malformed message to multiple phones may have denial of service impact on a larger scale

Description

Nortel Networks PC Client is a PC-based user application that provides a multimedia communications features to users. Improper message parsing vulnerability exists in SIP header parsing module of Nortel Networks PC Client which may allow a remote attacker to crash the client. This results in a complete denial of service to the user. Sending such message to multiple users may results in denial of service to large number of users. If restarted, the phone does function normally.

Solution

Phone SIP stack implementation should be patched to prevent exploiting such vulnerability.

Vendor Response: 

Nortel is aware of Security Advisory VIPER-2007-045 as issued by the Sipera Systems VIPER lab team. We are actively investigating the details in this Advisory to confirm that our latest SIP phones are not susceptible to this vulnerability. A formal Nortel Security Bulletin addressing this Advisory is expected to be available by July 31st.

 

For more information on any of these threat advisories, please email Sipera VIPER Lab at viper@sipera.com

UC Security Defined
Sipera Systems, the leader in real-time Unified Communications (UC) security, is the choice of enterprises and service providers around the world to support their mission-critical UC deployments.
Sipera offers groundbreaking, production-proven solutions that secure voice, video, messaging, collaboration, and other real-time communications in converged IP networks, boosting compliance with information security requirements.
Backed by the industry-leading research of the VIPER lab, Sipera's solutions provide comprehensive threat protection, policy enforcement, access control, and encryption in a single flexible appliance.

© Copyright 2010 Sipera Systems, Inc. All rights reserved. Sipera, Sipera UC-Sec and related products, SLiC, Sipera LAVA and Sipera VIPER are trademarks of Sipera Systems, Inc.