Sipera Viper Lab disclosed six threat advisories, and potential solutions, for SIP-based VOIP phones from Aastra, Polycom, and Snom
RICHARDSON, Texas -- Sipera VIPER Lab, operated by Sipera Systems, the leader in pure security for VoIP, mobile and multimedia communications, today disclosed six threat advisories, and potential solutions, for SIP-based VoIP phones from Aastra, Polycom and Snom. These threat advisories are in addition to the WiFi/dual-mode phone and general SIP vulnerabilities published earlier this spring by Sipera VIPER Lab.
The major threat advisories that affect these SIP phones include:
An improper error handling vulnerability in Aastra 9112i SIP phones, which may allow remote attackers to cause denial of service.
A format string vulnerability in Aastra 9112i SIP phones, which may allow remote attackers to cause denial of service.
A buffer overflow vulnerability in Polycom SoundPoint® IP 601 SIP phones, which may allow remote attackers to cause denial of service.
A vulnerability in HTTP service of Polycom SoundPoint IP 601 SIP phones, which may allow attackers to remotely reboot the phone.
An information leak vulnerability in Snom-320 SIP phones, which may allow remote access to users’ private call records.
A weak authentication vulnerability in Snom-320 SIP phones, which may allow a remote attacker to misuse the phone, causing multiple enterprise phones to ring simultaneously, or initiating costly toll calls on behalf of unsuspecting users.
“Unlike PCs and laptops, IP handsets act as servers on the network since they need to answer calls. With multiple open ports and services running on thousands of these IP handsets in the enterprise, they can be easily exploited by hackers and malicious users,” said Krishna Kurapati, Sipera founder/CTO and head of Sipera VIPER Lab. “As an example, one vulnerability exposed today could open an executive’s private call records, which would be particularly problematic for these organizations. Sipera works with its customers and vendors to identify and address these vulnerabilities before they become a major issue.”
About the Author(s)
You May Also Like
Guarding the Cloud: Top 5 Cloud Security Hacks and How You Can Avoid Them
April 4, 2024Cybersecurity Strategies for Small and Med Sized Businesses
April 11, 2024Defending Against Today's Threat Landscape with MDR
April 18, 2024Securing Code in the Age of AI
April 24, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024Black Hat Asia - April 16-19 - Learn More
April 16, 2024