VoIPShield, a VoIP security solutions company, announced new security vulnerabilities affecting Microsoft VoIP Products. The vulnerabilities affect applications using media stream protocols, such as RTP (Real-time Transport Protocol).

The products affected:

• Office Communications Server 2007
• Office Communicator
• Windows Live Messenger

These products deliver software-powered VoIP, presence, instant messaging and audio/video/Web conferencing functionality to end users. Microsoft estimates that over 250 million computers worldwide run these applications. All use RTP to deliver the content of the message; therefore all are vulnerable to this class of attack.

“Most of the attention in enterprise VoIP/UC security has been paid to the control channel, where SIP and other signalling protocols are used,” said Ken Kousky, CEO of CISSP certification training company IP3 Inc. and advisor to the VoIP Lab at Illinois Institute of Technology. “Until now, the media stream has been largely ignored by the security community as a source of malicious activity.  But attacks from these vectors have the potential to be dangerously persistent and widespread.”

The Microsoft vulnerabilities announced today, if exploited, cause a Denial of Service (DoS) condition against not only the stated applications but the entire desktop environment.

“Today’s announcements are just the tip of the iceberg,” said Andriy Markov, director of VoIPshield Labs. “Although they are specific to Microsoft’s applications, similar flaws exist in other VoIP vendors’ products. And many other media stream attacks exist that have more severe implications than service availability. We’re presently validating new research that shows an attacker can gain unauthorized access to an unsuspecting user’s laptop by manipulating the packets of a VoIP phone call. We believe that these attacks can even be made to traverse a PSTN gateway.”

VoIPshield has not publicly released the “full details” of the Microsoft VoIP vulnerabilities. VoIPshield, through it’s standard operating procedure, will first confidentially disclose the details to Microsoft and work with them to fix the applications.

VoIPshield Systems is a VoIP security solutions company founded in early 2005.  Headquartered in Ottawa, Canada, VoIPshield develops and markets the VoIPshield Security Suite, a set of security applications purpose-built to protect VoIP networks.