Cisco TelePresence ISDN Gateway Data Channel Denial of Service Vulnerability

Release date:
Updated on:

Affected Systems:
Cisco TelePresence ISDN Gateway 2.2 (1.92)
Cisco TelePresence ISDN Gateway
Description:
--------------------------------------------------------------------------------
Bugtraq id: 65072
CVE (CAN) ID: CVE-2014-0660

Cisco TelePresence ISDN Gateway is a high-performance video Gateway that enables ISDN network connections for Cisco TelePresence IP video infrastructure products and endpoints.

The Cisco TelePresence ISDN Gateway's ISDN Q.931 signal protocol processing code has a security vulnerability. unauthenticated remote attackers inject specially crafted data packets into the Q.931 stream, which can trigger data disconnection, all calls are interrupted and users cannot create new calls. This vulnerability is caused by the failure to properly process the specially crafted Q.931 STATUS message.

<* Source: Cisco

Link: http://tools.cisco.com/security/center/viewAlert.x? AlertId = 32460
Http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-isdngw
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Cisco
-----
Cisco has released a Security Bulletin (cisco-sa-20140122-isdngw) and patches for this:
Cisco TelePresence ISDN Gateway D-Channel Denial of Service Vulnerability cisco-sa-20140122-isdngw
Link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140122-isdngw