Mark Collier's VoIP/UC Security Blog

Vulnerability With Asterisk

Here is a description of a vulnerability with the AsterDex, digital rolodex feature for Asterisk:

http://www.hoku.co.uk/advisories/asteridex.txt

Vulnerability in Asterisk

There were a couple of references to a DoS vulnerability in Asterisk. A properly "fuzzed" packet can cause a DoS condition in several versions of Asterisk. Here are several links that describe the vulnerability:

http://www.securiteam.com/unixfocus/5VP0C0UKUO.html

http://seclists.org/fulldisclosure/2007/Mar/0315.html

http://www.kb.cert.org/vuls/id/228032

And a link from Digium/Asterisk with fixes:

http://bugs.digium.com/view.php?id=9313

Cisco Announces Vulnerability in Multiple IP Phones

Cisco announced a vulnerability with certain IP phones. It is pretty juicy. Here is the URL and a summary from their web site.

http://www.cisco.com/warp/public/707/cisco-sa-20070221-phone.shtml

Certain Cisco Unified IP Conference Station and IP Phone devices contain vulnerabilities which may allow unauthorized users to gain administrative access to vulnerable devices.

Cisco Unified IP Conference Station Administrative Bypass Vulnerability

Cisco Unified IP Conference Station 7935 and 7936 devices do not require a password when a URL is accessed directly via the administrator HTTP interface. There is a workaround for this vulnerability.

Cisco Unified IP Phone Default Account and Privilege Escalation Vulnerabilities

Cisco Unified IP Phone 7906G, 7911G, 7941G, 7961G, 7970G and 7971G devices contain a hard coded default user account with a default password which is remotely accessible via a Secure Shell (SSH) server enabled on the phone. This default user account may be leveraged to gain administrative access to a vulnerable phone via a privilege escalation vulnerability. The default user account may also execute commands causing a phone to become unstable and result in a denial of service. The default user account can not be disabled, removed or have its password changed. There are mitigations available for these vulnerabilities.

Another Book Review and VoIP Security Comments

Here is another Book review from Gary Audin from VoIPLoop. Gary did an early book review and provides more comments below. Gary also makes some good comments about VoIP security in general.

http://www.voiploop.com/index.php?option=com_content&task=view&id=1811#read-comments&mosmsg=Comment+Saved

Another Vulnerability

I found this on the Blue Box Podcast. It is a vulnerability that affects a chipset that is used by multiple VoIP phones:

http://www.securityfocus.com/bid/22191

Cisco Vulnerability

Cisco announced a vulnerability that affects IOS devices which support SIP. You can learn more at:

http://www.cisco.com/warp/public/707/cisco-sa-20070131-sip.shtml

Summary:

Cisco devices running an affected version of Internetwork Operating System (IOS) which supports Session Initiation Protocol (SIP) are affected by a vulnerability that may lead to a reload of the device when receiving a specific series of packets destined to port 5060. This issue is compounded by a related bug which allows traffic to TCP 5060 and UDP port 5060 on devices not configured for SIP.

There are no known instances of intentional exploitation of this issue. However, Cisco has observed data streams that appear to be unintentionally triggering the vulnerability.

Workarounds exist to mitigate the effects of this problem on devices which do not require SIP.