CVE-2012-1361 in IOS
Summary
by MITRE
Cisco IOS 15.1 and 15.2, when the Multicast Music-on-Hold (MMoH) feature of Cisco Unified Communications Manager (CUCM) is enabled, allows remote attackers to obtain sensitive crosstalk information by listening during a PSTN call, aka Bug ID CSCtx77750.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/07/2021
Cisco IOS version 15.1 and 15.2 contain a significant security vulnerability in the Multicast Music-on-Hold feature implementation that enables remote attackers to extract sensitive crosstalk information during PSTN calls. This vulnerability specifically affects systems where Cisco Unified Communications Manager is configured with MMoH functionality, creating an attack surface that compromises call integrity and potentially exposes confidential telecommunications data. The flaw operates through the multicast communication mechanisms used for music-on-hold services, allowing unauthorized monitoring of call traffic that should remain protected.
The technical implementation of this vulnerability stems from insufficient isolation between multicast traffic streams and the underlying signaling protocols used in PSTN communications. When MMoH is enabled, the system fails to properly segment multicast audio streams from the primary call path, creating opportunities for malicious actors to capture and analyze crosstalk information that would normally be protected. This represents a violation of information confidentiality principles and demonstrates inadequate network segmentation controls. The vulnerability falls under CWE-200, which addresses improper information exposure, and specifically relates to weak isolation between network services that should remain separate. Attackers can exploit this weakness by simply listening to multicast traffic streams during active calls, requiring no additional authentication or privileged access to the system.
The operational impact of this vulnerability extends beyond simple information disclosure, as the crosstalk information obtained can potentially reveal call routing patterns, user identification details, and other sensitive telecommunications data that could be leveraged for further attacks. This weakness particularly affects enterprise communications environments where Cisco Unified Communications Manager integrates with traditional PSTN infrastructure, creating a persistent threat vector that remains active as long as the MMoH feature remains enabled. The vulnerability's remote exploitation capability means that attackers can target affected systems from outside the local network perimeter, significantly expanding the potential attack surface. According to ATT&CK framework, this vulnerability maps to T1046 Network Service Scanning and T1005 Data from Local System, as it allows for passive network monitoring and information extraction from telecommunications infrastructure.
Organizations should immediately disable the MMoH feature on affected Cisco IOS versions until proper patches are applied and configurations are updated to ensure proper network segmentation. Network administrators should implement additional monitoring of multicast traffic streams to detect anomalous listening patterns and consider implementing network access controls that restrict multicast traffic to authorized endpoints only. The vulnerability also highlights the importance of regular security assessments of telecommunications infrastructure, particularly in environments where legacy PSTN systems interface with modern VoIP implementations. Cisco has issued patches and security advisories addressing this specific vulnerability, and organizations should prioritize applying these updates as part of their overall vulnerability management program to maintain compliance with security standards and reduce risk exposure.