Decade-old vulnerability found in globally popular office phone

Avaya's VOIP phones are used by 90% of Fortune 100 companies

A decade-old vulnerability has been found in the firmware of an Avaya desk phone used by the world's leading businesses.

The exploit could allow a hacker to perform a remote code execution (RCE) attack on the affected device providing they had access to the network to which the Avaya phone was connected.

Researchers were able to take over the normal operation of the phone, exfiltrate audio from the speakerphone and potentially bug the phone too.

The flaw actually sits in the phone's open source software, a fault that was first discovered in 2009 and has now been found once again in the Avaya 9600 series IP Deskphone by McAfee's Advanced Threat Research Team.

"We were able to find the presence of an RCE vulnerability in a piece of open source software that Avaya likely copied and modified 10 years ago, and then failed to apply subsequent security patches to," said McAfee senior security researcher Philippe Laulheret.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Avaya is the second largest voice over IP (VOIP) provider in the world behind Cisco and has an install base covering 90% of Fortune 100 companies, according to figures sourced by McAfee.

This is a classic case of unattended legacy technology coming back to bite businesses, according to Raj Samani, chief scientist and McAfee fellow.

"Legacy code and technical debt can be found everywhere in our increasingly connected world; if left unpaid, the resulting 'interest' can be detrimental," said Samani.

"Technology is only as secure as the weakest link in the chain, and this can many times be a device you might not expect," he added. "This highlights the importance of staying on top of network monitoring: if connected devices are talking with each other when they are not supposed to, this should raise red flags."

In Avaya's security advisory, published in July, it recommended all of its customers to deploy industry best practices such as implementing firewalls, ACLs, physical security and appropriate access restrictions until a fix was released.

Advertisement - Article continues below

"In this case, with a minimal hardware investment and free software, we were able to uncover a critical bug that remained out-of-sight for more than a decade," said Laulheret. "Avaya was prompt to fix the problem and the threat this bug poses is now mitigated, but it is important to realise this is not an isolated case and many devices across multiple industries still run legacy code more than a decade old."

McAfee urges companies that use the phone to check the model and its firmware to ensure they're not affected - the Avaya 9600 series IP Deskphone is the affected model but it also supports two different software stacks. Only the H.323 stack is affected as opposed to the SIP stack which is also compatible.

Featured Resources

Digitally perfecting the supply chain

How new technologies are being leveraged to transform the manufacturing supply chain

Download now

Three keys to maximise application migration and modernisation success

Harness the benefits that modernised applications can offer

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

The 3 approaches of Breach and Attack Simulation technologies

A guide to the nuances of BAS, helping you stay one step ahead of cyber criminals

Download now
Advertisement

Recommended

Visit/security/internet-security/354417/avast-and-avg-extensions-pulled-from-chrome
internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019
Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/operating-systems/25802/17-windows-10-problems-and-how-to-fix-them
operating systems

17 Windows 10 problems - and how to fix them

13 Jan 2020
Visit/hardware/354584/windows-10-and-the-tools-for-agile-working
Sponsored

Windows 10 and the tools for agile working

20 Jan 2020
Visit/microsoft-windows/32066/what-to-do-if-youre-still-running-windows-7
Microsoft Windows

What to do if you're still running Windows 7

14 Jan 2020
Visit/web-browser/30394/what-is-http-error-503-and-how-do-you-fix-it
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020