Decade-old vulnerability found in globally popular office phone

Avaya's VOIP phones are used by 90% of Fortune 100 companies

A decade-old vulnerability has been found in the firmware of an Avaya desk phone used by the world's leading businesses.

The exploit could allow a hacker to perform a remote code execution (RCE) attack on the affected device providing they had access to the network to which the Avaya phone was connected.

Researchers were able to take over the normal operation of the phone, exfiltrate audio from the speakerphone and potentially bug the phone too.

The flaw actually sits in the phone's open source software, a fault that was first discovered in 2009 and has now been found once again in the Avaya 9600 series IP Deskphone by McAfee's Advanced Threat Research Team.

"We were able to find the presence of an RCE vulnerability in a piece of open source software that Avaya likely copied and modified 10 years ago, and then failed to apply subsequent security patches to," said McAfee senior security researcher Philippe Laulheret.

Advertisement
Advertisement - Article continues below

Avaya is the second largest voice over IP (VOIP) provider in the world behind Cisco and has an install base covering 90% of Fortune 100 companies, according to figures sourced by McAfee.

This is a classic case of unattended legacy technology coming back to bite businesses, according to Raj Samani, chief scientist and McAfee fellow.

"Legacy code and technical debt can be found everywhere in our increasingly connected world; if left unpaid, the resulting 'interest' can be detrimental," said Samani.

"Technology is only as secure as the weakest link in the chain, and this can many times be a device you might not expect," he added. "This highlights the importance of staying on top of network monitoring: if connected devices are talking with each other when they are not supposed to, this should raise red flags."

In Avaya's security advisory, published in July, it recommended all of its customers to deploy industry best practices such as implementing firewalls, ACLs, physical security and appropriate access restrictions until a fix was released.

"In this case, with a minimal hardware investment and free software, we were able to uncover a critical bug that remained out-of-sight for more than a decade," said Laulheret. "Avaya was prompt to fix the problem and the threat this bug poses is now mitigated, but it is important to realise this is not an isolated case and many devices across multiple industries still run legacy code more than a decade old."

McAfee urges companies that use the phone to check the model and its firmware to ensure they're not affected - the Avaya 9600 series IP Deskphone is the affected model but it also supports two different software stacks. Only the H.323 stack is affected as opposed to the SIP stack which is also compatible.

Featured Resources

The IT Pro guide to Windows 10 migration

Everything you need to know for a successful transition

Download now

Managing security risk and compliance in a challenging landscape

How key technology partners grow with your organisation

Download now

Software-defined storage for dummies

Control storage costs, eliminate storage bottlenecks and solve storage management challenges

Download now

6 best practices for escaping ransomware

A complete guide to tackling ransomware attacks

Download now
Advertisement

Recommended

Visit/security/354156/google-confirms-android-cameras-can-be-hijacked-to-spy-on-you
Security

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

Visit/security/identity-and-access-management-iam/354289/44-million-microsoft-customers-found-using
identity and access management (IAM)

44 million Microsoft customers found using compromised passwords

6 Dec 2019
Visit/cloud/microsoft-azure/354230/microsoft-not-amazon-is-going-to-win-the-cloud-wars
Microsoft Azure

Microsoft, not Amazon, is going to win the cloud wars

30 Nov 2019
Visit/hardware/354237/five-signs-that-its-time-to-retire-it-kit
Sponsored

Five signs that it’s time to retire IT kit

29 Nov 2019
Visit/business/business-strategy/354195/where-modernisation-and-sustainability-meet-a-tale-of-two
Sponsored

Where modernisation and sustainability meet: A tale of two benefits

25 Nov 2019