[cisco-voip] Have you seen this article?

[Lelio Fulgenzi]

There's a CallManager 4.3(1)? WAH?????????????????????

--------------------------------------------------------------------------------
Lelio Fulgenzi, B.A.
Senior Analyst (CCS) * University of Guelph * Guelph, Ontario N1G 2W1
(519) 824-4120 x56354 (519) 767-1060 FAX (JNHN)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 
"I can eat fifty eggs." "Nobody can eat fifty eggs."
  ----- Original Message ----- 
  From: Ryan Ratliff 
  To: Leetun, Rob 
  Cc: ciscovoip 
  Sent: Wednesday, June 28, 2006 9:36 AM
  Subject: Re: [cisco-voip] Have you seen this article?


  http://www.cisco.com/en/US/products/sw/voicesw/ps556/ 
  tsd_products_security_response09186a00806c0846.html

  -Ryan

  On Jun 28, 2006, at 9:17 AM, Leetun, Rob wrote:

    Cisco Call Manager Flaw Could Invite Hackers

  Vulnerabilities in Cisco's Call Manager software could open the door  
  for hackers to reconfigure VoIP settings and gain access to  
  individual users' account information, according to researchers at  
  Kansas City, Mo.-based solution provider FishNet Security.

  By Kevin McLaughlin, CRN
  Jun 19, 2006
  URL:http://www.ddj.com/dept/security/189500728

  Vulnerabilities in Cisco's Call Manager software could open the door  
  for hackers to reconfigure VoIP settings and gain access to  
  individual users' account information, according to researchers at  
  Kansas City, Mo.-based solution provider FishNet Security.

  In a report issued Monday, Jake Reynolds, senior security engineer at  
  FishNet, said the vulnerability affects versions 3.1 and higher of  
  Call Manager, which handles call routing and call signaling functions  
  in Cisco VoIP systems. A lack of input validation and output encoding  
  in the Web administration interface for Call Manager could allow  
  hackers to execute cross-site scripting attacks, Reynolds wrote.

  Cross site scripting attacks usually involve tricking users with  
  access privileges into clicking on a URL in an email or Web page.

  In the Call Manager scenario, attackers would send a request to the  
  Call Manager Web interface that causes malicious JavaScript to be  
  included. If the administrator could be tricked into submitting this  
  tainted request, the malicious code would execute in the victim's Web  
  browser and potentially give attackers the ability to delete or  
  reconfigure system components and gain access to confidential user  
  information, according to the report.

  In a statement, Cisco's Product Security Incident Response Team  
  (PSRIT) recommended that users verify link destinations before  
  clicking on URLs.

  Although there are no workarounds for the issue, Cisco has fixed the  
  vulnerability and fixes will be incorporated in all supported  
  CallManager trains in versions 4.3(1), 4.2(3), 4.1(3)SR4 and 3.3(5) 
  SR3, according to the statement.

  To guard against attacks, FishNet recommends that companies limit  
  network connectivity to Call Manager wherever possible to prevent  
  hackers from discovering public Web interfaces.

  "Simple Google queries are all an attacker needs in this case to  
  obtain the target Call Manager address. There are few compelling  
  reasons one could present that would justify public access to Call  
  Manager web interfaces," according to the report.

  _______________________________________________
  cisco-voip mailing list
  cisco-voip at puck.nether.net
  https://puck.nether.net/mailman/listinfo/cisco-voip

  _______________________________________________
  cisco-voip mailing list
  cisco-voip at puck.nether.net
  https://puck.nether.net/mailman/listinfo/cisco-voip
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://puck.nether.net/pipermail/cisco-voip/attachments/20060628/bf15eb7c/attachment.html