Michael Scheidell has reported a vulnerability in 3Com SuperStack 3 NBX Networked Telephony Solution and NBX 100 Communications Systems, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to an error in the embedded FTP service when processing CEL commands and can be exploited via a CEL command with an overly long argument (about 2048 bytes).

Successful exploitation disables the FTP service, the integrated web-based administrative console, and the call manager. A hard reboot is required to regain functionality.

Solution
Restrict access to the FTP service.

Provided and/or discovered by
Michael Scheidell, SECNAP Network Security.

Changelog
Further details available in Customer Area

Original Advisory
SECNAP Network Security:
http://www.secnap.com/alerts.php?pg=6

Deep Links
Links available in Customer Area