Advisory ID: cisco-sa-20040121-voice
For Public Release 2004 January 21 17:00 UTC (GMT)
The default installation of Cisco voice products on the IBM platform
will install the Director Agent in an unsecure state, leaving the Director
services vulnerable to remote administration control and/or Denial of Service
attacks. The vulnerabilities can be mitigated by configuration changes and
Cisco is providing a repair script that will close the vulnerable ports and put
the Director agent in secure state without requiring an upgrade.
This advisory will be available at
Cisco voice products running on IBM servers installed with the default
configurations are affected if they leave TCP or UDP port 14247 open. To verify
this vulnerability, the administrator may open a command window on the server
and type netstat -a. If port 14247 is listed, the server is
vulnerable to remote administrative control and Denial of Service
Affected Cisco voice products:
Cisco IP Interactive Voice Response (IP IVR)
Cisco IP Call Center Express (IPCC Express)
Cisco Personal Assistant (PA)
Cisco Emergency Responder (CER)
Cisco Conference Connection (CCC)
Cisco Internet Service Node (ISN) running on an IBM with an affected
Affected IBM-based server model numbers:
IBM X330 (8654 or 8674)
Affected OS Versions:
All operating system (OS) versions running on an IBM server prior to
OS 2000.2.6, which has not yet been released as of the date of this
No other Cisco products are currently known to be affected by these vulnerabilities.
The default installations of Cisco voice products on IBM servers will
install IBM Director in unsecure state leaving TCP and UDP ports 14247 open.
Any Director Server/Console agent can connect over port 14247 to gain
administrative level control without requiring authentication. Also, a network
security scanner scanning port 14247 can trigger the IBM Director agent process
twgipc.exe to use 100% of the CPU until the server is rebooted. These
vulnerabilities are documented in the two Cisco bug IDs:
CSCed33037 — IBM Director agents default install
allows remote access.
CSCed23357 — IBM servers with Director agent 2.2 or
3.11 are vulnerable to a DoS.
Cisco has not provided scores for the vulnerabilities in this advisory based on the Common Vulnerability Scoring System (CVSS). At the time of original publication, CVSS scoring in Cisco security publications was not yet adopted.
A Cisco voice server with the IBM Director agent in unsecure state is
susceptible to administrative level control and Denial of Service
Administrative level control includes the following functionality:
shutdown/power off/restart, remote command shell, file transfer,
processes/services/device drivers stop and start, network configuration
modification (including domain/workgroup membership), Windows 2000 user account
creation, and SNMP configuration modification.
In a Denial of Service attack, an attacker can render the Cisco voice
server inoperative with CPU utilization spiking to 100%, and the IBM server
must be powered off or rebooted in order to regain control of the
When considering software upgrades, also consult
and any subsequent advisories to determine exposure and a complete upgrade
In all cases, customers should exercise caution to be
certain the devices to be upgraded contain sufficient memory and that current
hardware and software configurations will continue to be supported properly by
the new release. If the information is not clear, contact the Cisco Technical
Assistance Center (TAC) or your contracted maintenance provider for assistance.
The vulnerabilities are specific to Cisco voice products on IBM servers
and all vulnerabilities listed in this advisory can be mitigated with the
repair script without requiring an upgrade.
The repair script is available at:
Cisco's repair script adds 3 levels of improved security to the
The Director agent no longer listens on TCP or UDP ports 14247 for
remote connections from a Director Server. This change prevents the Denial of
Service attacks described in the Impact section.
The repair script secures the Director agent such that even if port
14247 is reenabled, the Director agent still would not accept connections from
any Director Server.
The Director Agent executable files which are not necessary to the
functioning of the program, yet provide high levels of access or control, are
completely disabled by this repair script.
Note: If you are using IBM Director Server and Console to monitor the Cisco
voice products, this repair script will disable the connection to those IBM
servers. The Director agents will still provide pop-up warnings and Event
Viewer messages in version 3.11, and SNMP traps to network management software
like CiscoWorks IP Telephony Monitor. To regain IBM Director Server monitoring
capabilities, IBM Director agent 4.11 will be released in OS Upgrade 2000.2.6
and support can be re-enabled for Director Server after the upgrade to OS
As the mitigation for the vulnerabilities is a repair script, a
software upgrade is not required to address the vulnerabilities. However, if
you have a service contract, and wish to upgrade to unaffected code, you may
obtain upgraded software through your regular update channels once that
software is available. For most customers, software patches and bug fixes should be obtained through the Software Center on Cisco's Worldwide Web site at
Do not contact firstname.lastname@example.org or email@example.com for software upgrades
Customers with contracts should obtain software through their regular update channels. For most customers, software patches and bug fixes should be obtained through the Software Center on Cisco's worldwide website at http://www.cisco.com
Customers whose Cisco products are provided or maintained through prior or existing agreements with third-party support organizations, such as Cisco Partners, authorized resellers, or service providers should contact that support organization for guidance and assistance with the appropriate course of action in regards to this advisory.
The effectiveness of any workaround or fix is dependent on specific customer situations, such as product mix, network topology, traffic behavior, and organizational mission. Due to the variety of affected products and releases, customers should consult with their service provider or support organization to ensure any applied workaround or fix is the most appropriate for use in the intended network before it is deployed.
Customers who purchase direct from Cisco but do not hold a Cisco
service contract, and customers who purchase through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain software patches and bug fixes by contacting the Cisco Technical Assistance Center (TAC). TAC
contacts are as follows.
+1 800 553 2447 (toll free from within North America)
+1 408 526 7209 (toll call from anywhere in the world)
Customers should have the product serial number available and be prepared to provide the URL of this notice as evidence of entitlement to a software patch or bug fix. Customers without service contracts should request a software patch or bug fix through the TAC.
for additional TAC contact information, including localized telephone numbers,
and instructions and e-mail addresses for use in various languages.
The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
THIS DOCUMENT IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.
A stand-alone copy or Paraphrase of the text of this document that omits the distribution URL in the following section is an uncontrolled copy, and may lack important information or contain factual errors.
This advisory is posted on Cisco's worldwide website at:
In addition to worldwide web posting, a text version of
this notice is clear-signed with the Cisco PSIRT PGP key and is posted to the
following e-mail and Usenet news recipients.
Future updates of this advisory, if any, will be placed on Cisco's
worldwide website, but may or may not be actively announced on mailing lists or
newsgroups. Users concerned about this problem are encouraged to check the
above URL for any updates.
Initial public release.