Sometimes threats come to light only after they’ve been around for long enough to cause concern for the public. This was the case with a new bug found in Apple’s FaceTime app that allowed users to spy on others without their consent through group FaceTime calls. Thankfully, a patch has been issued that resolves it, but perhaps the way that it was implemented is the most interesting of all.
You’d think that Intel would make sure their firmware is of sound integrity, but unfortunately, a recently discovered vulnerability has revealed that it’s not as secure as previously thought. The issue involving Intel’s chips could potentially lead to a permanent nosedive for your CPU’s capacity to perform as intended, which could have disastrous implications for your business.
Cisco Wednesday issued two separate security alerts concerning its unified communications products – the third UC-related alert of this year. One of the alerts issued this week concern flaws in Cisco’s Unified IP Phone models, specifically related to the company’s Skinny Call Control Protocol (SCCP, or “Skinny”) and Session Initiation Protocol (SIP), while the other relates to an SQL Injection attack that could affect Cisco’s Unified Communications Manager – formerly CallManager.
According to Cisco, a number of its IP phones contain multiple overflow and denial-of-service vulnerabilities. Certain phones running SCCP and/or SIP firmware are vulnerable (see the list at the Cisco advisory). SCCP- and SIP-based phones contain a buffer overflow vulnerability in the handling of DNS responses. A specially-crafted DNS response may be able to trigger a buffer overflow and execute arbitrary code on a vulnerable phone, says Cisco. The hole is fixed in SCCP firmware version 8.0(8) and SIP firmware version 8.8(0).
