HPSBGN01004 SSRT3614 rev.2 - HP OpenCall Multiservice Controller, Remote Denial of Service (DoS)

  • KM02992240
  • 17-Oct-2017
  • 17-Oct-2017

Summary

A potential security vulnerability has been identified in the HP OpenCall MultiService Controller (OCMC) H.323 stack that may allow a remote user to create a Denial of Service (DoS).

Reference

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: KM02992240 (c01037794)

Version: 2

HPSBGN01004 SSRT3614 rev.2 - HP OpenCall Multiservice Controller, Remote Denial of Service (DoS)
NOTICE: The information in this Security Bulletin should be acted upon as soon as possible.

Release Date: 2004-05-11

Last Updated: 2007-04-26


Potential Security Impact: Remote Denial of Service (DoS)

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY

A potential security vulnerability has been identified in the HP OpenCall MultiService Controller (OCMC) H.323 stack that may allow a remote user to create a Denial of Service (DoS).

References: none

SUPPORTED SOFTWARE VERSIONS*: ONLY impacted versions are listed.

HP OpenCall MultiService Controller (OCMC) v1.1, v1.2 for HP-UX 11.0

BACKGROUND

For a PGP signed version of this security bulletin please write to: security-alert@hp.com

The HP Software Security Response team has contacted the source and various other vendors and is not aware of any malicious exploitation of any of the vulnerabilities described in this bulletin.

A test suite developed by the U.K. National Infrastructure Security Co-ordination Centre (NISCC) and the University of Oulu Security Programming Group (OUSPG) has exposed vulnerabilities in several implementations of the H.323 protocol.

The potential vulnerabilities may be exploited to produce a denial of service (DoS) attack. Such an attack may cause an affected product to failover or crash and failover. Due to its robust design OCMC will recover from most attack scenarios. In the event that OCMC does not recover, the attack can be stopped by blocking the offending IP address. Attacks may also be blocked by creating an access list to restrict TCP port 1720 traffic to known, trusted IP addresses.

RESOLUTION

HP has made the following patches available for OCMC v1.2 released January 2004. Please contact OpenCall support to receive the patches.

SEP_GK.05.09.P1155 
SCE_GK.05.09.P1156

HP will be providing patches to the impacted versions of OCMC:

OCMC v1.1 patch 46 
OCMC v1.1 patch 37

HISTORY 
Revision: 0 (rev.0) - 11 May 2004 Initial release 
Version: 1 (rev.1) - 9 July 2005 Patches are available for OCMC v1.2 released January 2004 
Version: 2 (rev.2) - 25 April 2007 Reformatted

©Copyright 2007 Hewlett-Packard Development Company, L.P.
Hewlett-Packard Company shall not be liable for technical or editorial errors or omissions contained herein. The information provided is provided "as is" without warranty of any kind. To the extent permitted by law, neither HP or its affiliates, subcontractors or suppliers will be liable for incidental,special or consequential damages including downtime cost; lost profits;damages relating to the procurement of substitute products or services; or damages for loss of data, or software restoration. The information in this document is subject to change without notice. Hewlett-Packard Company and the names of Hewlett-Packard products referenced herein are trademarks of Hewlett-Packard Company in the United States and other countries. Other product and company names mentioned herein may be trademarks of their respective owners.