Multiple Cisco products contain vulnerabilities in the H.323 protocol implementation, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerabilities are caused due to various errors in the processing of H.225.0 and Q.931 messages over TCP, which can be exploited by sending specially crafted messages to an affected system (default port 1720/tcp).

Successful exploitation may crash or reboot vulnerable devices and applications or cause them to consume 100% CPU resources.

The vulnerabilities affect the following products with H.323 support:

* Cisco IOS 11.3T and later versions
* Cisco CallManager versions 3.0 through 3.3
* Cisco Conference Connection (CCC)
* Cisco Internet Service Node (ISN)
* Cisco BTS 10200 Softswitch
* Cisco 7905 IP Phone H.323 Software Version 1.00
* Cisco ATA 18x series products running H.323/SIP loads with versions earlier than 2.16.1

Solution
See patch matrices and workarounds in original advisory:
Further details available in Customer Area

Provided and/or discovered by
NISCC

Changelog
Further details available in Customer Area

Original Advisory
Cisco:
http://www.cisco.com/warp/public/707/cisco-sa-20040113-h323.shtml

NISCC:
http://www.uniras.gov.uk/vuls/2004/006489/h323.htm

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area