CNET is reporting that routers running the IOS Telephony Service, Cisco CallManager Express and Survivable Remote Site Telephony features could be vulnerable.
The CallManager Express feature enables Cisco IP routers to handle call processing for Cisco IP phones. Cisco said in its warning that certain "malformed packets" sent to the port handling the Skinny Call Control Protocol may cause the device to reload. An attacker exploiting this bug could flood the device with malformed packets that would cause the device to reload over and over again, causing a denial-of-service attack.
Although there are no reports of this attack causing VoIP phones to crash or reboot, the possibility of hackers causing a major corporation with hundreds of Cisco IP phones deployed could cost the company millions - not to mention a very bad black eye for the VoIP industry.
Let's hope Cisco fixed the bug quickly and that this is the last we hear of a vulnerability in their IOS operating system or at least none that affects their VoIP offerings. Wishful thinking I am sure...
