First Virtual Communications has acknowledged some vulnerabilities in various products' H.323 protocol implementation, which can be exploited by malicious people to cause a DoS (Denial-of-Service).

The vulnerabilities are caused due to errors in the processing of H.225 messages over TCP. This can be exploited by malicious people to crash an affected device by sending specially crafted messages to it (default port 1720/tcp).

Versions of the following products are affected by the H.323 vulnerabilities:
* Click to Meet Express (when used with H.323 conferencing endpoints)
* Click to Meet Premier
* Conference Server
* V-Gate

Solution
The vendor reports that patches and updated versions will be available for some products. Customers with contracts should obtain these through their regular update channels.
Further details available in Customer Area

Provided and/or discovered by
NISCC

Original Advisory
http://support.fvc.com/eng/docs/misc_docs/H.323_Security_Bulletin.pdf

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area