Cisco VoIP technology open to DoS attacks

In an advisory, the networking giant said CallManager versions 3.3, 4.1, 4.2 and 5.0, in addition to Presence Server version 1.0, are affected by the flaws.

The most severe of the five vulnerabilities rated 4.7 out of 10 on Cisco's vulnerability scoring system. 

Currently there are no workarounds for the bugs, and the company is developing a permanent fix, which will be distributed when it becomes available, according to a Cisco advisory. In the meantime, users should filter traffic as described in the advisory.

Andrew Storms, director of security operations for nCircle, said the flaws are relatively easy to exploit and can result in a loss of telephone service for an enterprise.

"In one instance, simply sending a large number of [internet control] message protocol) packets to a Cisco Unified CallManager can cause the system to crash," he said.

CallManager provides processing for Cisco's  VoIP software solutions, while the Presence Server tracks the usage of those products.