Decade-old vulnerability found in globally popular office phone

Avaya's VOIP phones are used by 90% of Fortune 100 companies

A decade-old vulnerability has been found in the firmware of an Avaya desk phone used by the world's leading businesses.

The exploit could allow a hacker to perform a remote code execution (RCE) attack on the affected device providing they had access to the network to which the Avaya phone was connected.

Researchers were able to take over the normal operation of the phone, exfiltrate audio from the speakerphone and potentially bug the phone too.

The flaw actually sits in the phone's open source software, a fault that was first discovered in 2009 and has now been found once again in the Avaya 9600 series IP Deskphone by McAfee's Advanced Threat Research Team.

"We were able to find the presence of an RCE vulnerability in a piece of open source software that Avaya likely copied and modified 10 years ago, and then failed to apply subsequent security patches to," said McAfee senior security researcher Philippe Laulheret.

Avaya is the second largest voice over IP (VOIP) provider in the world behind Cisco and has an install base covering 90% of Fortune 100 companies, according to figures sourced by McAfee.

This is a classic case of unattended legacy technology coming back to bite businesses, according to Raj Samani, chief scientist and McAfee fellow.

"Legacy code and technical debt can be found everywhere in our increasingly connected world; if left unpaid, the resulting 'interest' can be detrimental," said Samani.

"Technology is only as secure as the weakest link in the chain, and this can many times be a device you might not expect," he added. "This highlights the importance of staying on top of network monitoring: if connected devices are talking with each other when they are not supposed to, this should raise red flags."

In Avaya's security advisory, published in July, it recommended all of its customers to deploy industry best practices such as implementing firewalls, ACLs, physical security and appropriate access restrictions until a fix was released.

"In this case, with a minimal hardware investment and free software, we were able to uncover a critical bug that remained out-of-sight for more than a decade," said Laulheret. "Avaya was prompt to fix the problem and the threat this bug poses is now mitigated, but it is important to realise this is not an isolated case and many devices across multiple industries still run legacy code more than a decade old."

McAfee urges companies that use the phone to check the model and its firmware to ensure they're not affected - the Avaya 9600 series IP Deskphone is the affected model but it also supports two different software stacks. Only the H.323 stack is affected as opposed to the SIP stack which is also compatible.

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Recommended

How to encrypt files and folders in Windows 10
encryption

How to encrypt files and folders in Windows 10

9 Apr 2021
The definitive guide to IT security
Whitepaper

The definitive guide to IT security

9 Apr 2021
Evidence suggests REvil behind Harris Federation ransomware attack
ransomware

Evidence suggests REvil behind Harris Federation ransomware attack

9 Apr 2021
Fujitsu taps Trend Micro to secure private 5G networks in smart factories
5G

Fujitsu taps Trend Micro to secure private 5G networks in smart factories

8 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
Hackers are using fake messages to break into WhatsApp accounts
instant messaging (IM)

Hackers are using fake messages to break into WhatsApp accounts

8 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021