############################################################# # # COMPASS SECURITY ADVISORY http://www.csnc.ch/ # ############################################################# # # Product: IP Phone # Vendor: Nortel # Subject: IP Phone forced re-authentication # Risk: High # Effect: Currently exploitable # Author: Daniel Stirnimann (daniel.stirnimann (at) csnc (dot) ch) # Date: October, 18th 2007 # ############################################################# Introduction: ------------- The UNIStim signalisation protocol is vulnerable against spoofed re-authentication messages. A malicious user can send spoofed registration messages to the server to which a UNIStim IP phone is connected. This can force the legitimate IP phone into a situation where it must re-register with the server to maintain service. A continuous stream of these messages prevents the IP phone from properly registering. Nortel has noted this as: Title: DoS Potential Vulnerability - UNIStim IP Phone Forced to Re-register Number: 2007008385 http://support.nortel.com/go/main.jsp?cscat=SECUREADVISORY Vulnerable: ----------- Nortel IP Phone 1140E IP Softphone 2050 and others. See associated products on the Nortel advisory. Vulnerability Management: ------------------------- June 2007: Vulnerability found June 2007: Nortel Security notified October 2007: Nortel Advisory & Patches available October 2007: Compass Security Information Remediation: ------------ Follow the recommended actions for the affected systems, as identified in the Nortel Advisory. Technical Description: ---------------------- A malicious user can send a resume message to the signaling server to which an IP phone is connected. The resume message is a UNIStim UDP datagram. In order for the signaling server to detect which IP phone wants to resume the connection it reads the source IP address from the UDP datagram to identify the client. That means we can send a spoofed resume UNIStim UDP datagram. The server sends the new sequence number back to the IP phone. However, because we spoofed the above message, we don't see the response. The effect is that, the IP phone is out of sync with the server. During this time, the IP phone can not take on or make any calls. As soon as the IP phone realizes that it is out of sync (watchdog timeout expired) it will re-authenticate against the signaling server. Note that if the malicious user continues to send spoofed resume messages the hard phone will not be able to go online. Reference: http://www.csnc.ch/static/advisory/secadvisorylist.html