Description
Several services on Unity listen on dynamic UDP ports. Of these services a number are vulnerable to a Denial of Service (DoS) when sent crafted packets. [UPDATE February 10, 2009] - Microsoft has issued a Security Bulletin around this vulnerability listed as "Microsoft Security Bulletin MS090003 - Critical'. All of the details pertaining to this bulletin can be found at http://www.microsoft.com/technet/security/bulletin/ms09-003.mspx
Recommendations
Cisco has acknowledged the issue and is working with Microsoft on resolving it. More details could be found at http://www.cisco.com/warp/public/707/cisco-sr-20081008-unity.shtml. I n the short term it is recommended that a VoIP aware IPS product, such as VoIPguard, with signatures to detect attempts to exploit this issue, be implemented to prevent it from being exploited. Implementing best practices can limit the exposure of this issue. Cisco customers with a valid support agreement may wish to speak with their support contact in order to obtain further vendor details