Vulnerabilities in Cisco 802.1x voice-enabled interfaces

Madrid, June 10, 2005 - Cisco has reported, at http://www.cisco.com/warp/public/707/cisco-sn-20050608-8021x.shtml a vulnerability in Cisco CallManager devices and in Cisco switches enabled to support IP voice, which could allow a user to falsify the Cisco Discovery Protocol (CDP) to gain anonymous voice VLAN access.

The problem lies in the possibility of abusing voice VLAN access and even if 802.1x port-security level is enabled. Cisco acknowledges that Cisco IP Phones do not currently contain 802.1x supplicants, and are authorized to join the voice VLAN without 802.1x authentication.

The Cisco security notice includes solutions, which users that could be affected should refer to. Users running new versions of software in the Cisco Catalyst switches can take advantage of several characteristics that can help limit the action a device can carry out while on the network. These characteristics include DHCP Snooping and Port Security, Dynamic ARP Inspection (DAI) and IP Source Guard.

The white paper entitled ˝Cisco Catalyst Integrated Security-Enabling the Self-Defending Network˝ introduces the features on the Catalyst switches which can mitigate Layer 2 and Layer 3 attacks against the switch and devices connected through it. This document is available at: http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper0900aecd8015f0ae.shtml.

Oxygen3 24h-365d, by Panda Software
© Panda Software 2003

2005-06-11 16:30

Back

IT News: