[ news_security_news ]
Cisco Patching Up A Few Holes
John Stith
Staff Writer
2005-07-15
 Insider Reports RSS Feed
Cisco, the networking hardware monster, ironed on some patches for vulnerabilities found in their VoIP products that allow nefarious hackers to unscrupulously eavesdrop on private conversations and could be used to cause the vicious denial-of-service attacks so dreaded by users of the Internet.
Internet Security Systems (ISS) X-Force team found this set of flaws in Cisco's Call Manager, which is one of the key components to all of Cisco's VoIP system that handles call signaling and routing.
According to ISS's security alert, the damage is done by sending specially-crafted packets, an attacker is able to trigger a heap overflow within a critical Call Manager process, causing both a denial of service condition and enabling an attacker to completely compromise the Call Manager server.
"Like many of the applications that are driving today's businesses, VoIP travels over a variety of networks and the public Internet and is therefore susceptible to the same security perils as other staple network components like e-mail, databases and servers," said Chris Rouland, chief technology officer at Internet Security Systems.
This could create real problems for folks using the VoIP system as both privacy and actual serviceability to customers could become a real problem. Fortunately, these vulnerabilities have been fixed. Cisco worked out the patches before ISS actually made their official announcement. Cisco said no attacks have been found.
Rouland went on to say, "Voice over Internet Protocol is increasingly being adopted by corporations that wish to save money on telecommunications costs and streamline their communication infrastructure, providing employees with advanced features while simplifying administration processes."
As Cisco is the big dog on when it comes to router products, it remains crucial for them to maintain high security levels for all their products. Cyber security continues to receive a higher emphasis from the Dept. of Homeland Security and this is one good step to show the private industry works hard on its own.
About the Author:
John is a staff writer for SecurityProNews covering cyber security.
More news_security_news Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
