ShoreTel Mobility Client iOS Application - MITM SSL Certificate Vulnerability (CVE-2016-6562) Overview "The Mobility Client extends the enterprise desk phone features and UC capabilities to the iOS device, integrating into the PBX, enabling VoIP, Cellular, and video calling." "aC/ Make and receive enterprise VoIP and Video calls over your office WLAN or cellular data networks" "aC/ Maintain active calls when you walk away from a WLAN coverage area with its automatic handover of calls from WLAN to the GSM voice network" "aC/ Automatically route international calls through your office PBX to reduce long distance charges" "aC/ Perform directory lookups of your co-workers when you donat remember their phone number" "aC/ Integrate with ShoreTel Communicator or ShoreTel Connect to control your mobile device through your Mac desktop" "aC/ Access visual voice mail (ShoreTel UC systems)" "aC/ Integrated "Today" calendar integration enables users to join ShoreTel, WebEx, and GoToMeeting conference calls with a single click" (https://itunes.apple.com/us/app/shoretel-mobility-client/id479054518) Issue The ShoreTel Mobility Client iOS application (version 9.1.2.101 and below), does not validate the SSL certificate it receives when connecting to the mobile application login server. Impact An attacker who can perform a man in the middle attack may present a bogus SSL certificate which the application will accept silently. Usernames, passwords and sensitive information could be captured by an attacker without the user's knowledge. Timeline July 15, 2015 - Attempted to notify ShoreTel via security@shoretel.com, email bounced July 15, 2015 - Resent the vulnerability details to support@shoretel.com & skysupport@shoretel.com October 5, 2016 - Provided the vulnerability details to CERT/CC October 17, 2016 - CERT/CC confirmed ShoreTel received the vulnerability report and are working on an updated version January 3, 2017 - CERT/CC published vulnerability note VU#475907 Solution The ShoreTel Mobility Client iOS application version as of January 3, 2017 (9.1.2.101) is vulnerable CVE-ID: CVE-2016-6562 CERT/CC Report http://www.kb.cert.org/vuls/id/475907 Questions? http://www.info-sec.ca/contact.html