Description
Session management on the Unity server appears to be restricted and this allows a malicious user to use up all available sessions denying access to a legitimate administrator. Restoring the ability for new sessions to be established requires a complete system reboot, since simply restarting the default website is insufficient. If anonymous access is provided, which is the default configuration so that users don’t require the entry of domain credentials prior to viewing the Unity login page, no authentication is required to initiate this DoS.
Recommendations
Cisco has acknowledged the issue and is issuing patches to correct it. More details could be found at http://www.cisco.com/warp/public/707/cisco-sr-20081008-unity.shtml. In the short term it is recommended that a VoIP aware IPS product, such as VoIPguard, with signatures to detect attempts to exploit this issue, be implemented to prevent it from being exploited. Implementing best practices can limit the exposure of this issue. Cisco is recommending to use Unity integrated login feature. Cisco customers with a valid support agreement may wish to speak with their support contact in order to obtain further vendor details.