Sipera Viper Lab Finds VOIP Vulnerabilities
Sipera Viper Lab disclosed six threat advisories, and potential solutions, for SIP-based VOIP phones from Aastra, Polycom, and Snom
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
RICHARDSON, Texas -- Sipera VIPER Lab, operated by Sipera Systems, the leader in pure security for VoIP, mobile and multimedia communications, today disclosed six threat advisories, and potential solutions, for SIP-based VoIP phones from Aastra, Polycom and Snom. These threat advisories are in addition to the WiFi/dual-mode phone and general SIP vulnerabilities published earlier this spring by Sipera VIPER Lab.
The major threat advisories that affect these SIP phones include:
An improper error handling vulnerability in Aastra 9112i SIP phones, which may allow remote attackers to cause denial of service.
A format string vulnerability in Aastra 9112i SIP phones, which may allow remote attackers to cause denial of service.
A buffer overflow vulnerability in Polycom SoundPoint® IP 601 SIP phones, which may allow remote attackers to cause denial of service.
A vulnerability in HTTP service of Polycom SoundPoint IP 601 SIP phones, which may allow attackers to remotely reboot the phone.
An information leak vulnerability in Snom-320 SIP phones, which may allow remote access to users’ private call records.
A weak authentication vulnerability in Snom-320 SIP phones, which may allow a remote attacker to misuse the phone, causing multiple enterprise phones to ring simultaneously, or initiating costly toll calls on behalf of unsuspecting users.
“Unlike PCs and laptops, IP handsets act as servers on the network since they need to answer calls. With multiple open ports and services running on thousands of these IP handsets in the enterprise, they can be easily exploited by hackers and malicious users,” said Krishna Kurapati, Sipera founder/CTO and head of Sipera VIPER Lab. “As an example, one vulnerability exposed today could open an executive’s private call records, which would be particularly problematic for these organizations. Sipera works with its customers and vendors to identify and address these vulnerabilities before they become a major issue.”
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024