Actu
Vigil@nce: Microsoft OCS, denial of service via SIP
December 2008 by Vigil@nce
An attacker can send SIP INVITE queries in order to create a
denial of service in Microsoft Office Communications Server.
– Gravity: 2/4
– Consequences: denial of service of service
– Provenance: intranet client
– Means of attack: 1 attack
– Ability of attacker: technician (2/4)
– Confidence: unique source (2/5)
– Diffusion of the vulnerable configuration: high (3/3)
– Creation date: 02/12/2008
IMPACTED PRODUCTS
– Microsoft Office Communication Server
DESCRIPTION
The Microsoft Office Communications Server product implements SIP
(Session Initiation Protocol) used for multimedia exchanges. This
protocol defines following queries:
– INVITE : the client requests a new session
– ACK : the server acknowledges
– BYE : ends a session
– etc.
When MOCS receives a special SIP INVITE query, it does not free
the associated memory.
An attacker can therefore send numerous queries in order to
progressively deplete the memory.
CHARACTERISTICS
– Identifiers: CVE-2008-5180, VIGILANCE-VUL-8277
– Url: http://vigilance.fr/vulnerability/8277
