Description
The Nortel Communications Server 1000 provides a number of web resources to phones and administrators. By accessing this information an attacker could plan an attack that would have a greater chance of success due to have had their contents and the web application structure disclosed to them.
Recommendations
To completely address the issue requires a patch from Nortel. In the short term it is recommended that a VoIP aware IPS product, such as VoIPguard, with signatures to detect attempts to exploit this issue, be implemented to prevent it from being exploited. In addition, implementation of general best practice guidance such as controlling access to telephony networks via VLANs, access control lists, firewalls, network admission controls and/or other security devices will aid in limiting the exposure of this vulnerability. Nortel customers with a valid support agreement may wish to speak with their support contact in order to obtain additional vendor details.