mailing list archives
VULNERABLE and COMPLETELY outdated 3rd-party libraries/components used in 3CX Phone 6
From: "Stefan Kanthak" <stefan.kanthak () nexgo de>
Date: Mon, 6 May 2013 15:30:42 +0200
the current 3CXPhone6.msi (for Windows), available from
<http://www.3cx.com/VOIP/sip-phone/>, digitally signed on 2012-07-30,
installs the following outdated and vulnerable 3rd-party libraries:
* libeay32.dll and ssleay32.dll version 0.9.8h (from 2008-05-28)
The current version of OpenSSL is 0.9.8y, see
<http://www.openssl.org/>, it fixes about 20 CVEs found in earlier
versions downto 0.9.8h.
* FFmpeg/FFdshow version 1.1.0
The current version of FFmpeg/FFdshow is 1.2, see
<http://www.ffmpeg.org/security.html> for the 24 fixed CVEs since
2013-05-03 vendor informed
2013-05-05 vendor replied:
"3CX Phone is freeware, use another software"
I second that: don't use software from 3CX!
2013-05-06 report published
- VULNERABLE and COMPLETELY outdated 3rd-party libraries/components used in 3CX Phone 6 Stefan Kanthak (May 06)