PhonerLite 2.14 SIP Soft Phone – SIP Digest Disclosure
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 I. Advisory Summary Title: SIP Digest Leak Information Disclosure in PhonerLite 2.14 SIP Soft Phone Date Published: March 30, 2014 Vendors contacted: Heiko Sommerfeldt, PhonerLite author Discovered by: Jason Ostrom Severity: Medium II. Vulnerability Scoring Metrics CVE Reference: CVE-2014-2560 CVSS v2 Base Score: 4.3 CVSS v2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N) Component(s): PhonerLite SIP Soft Phone Class: Information Disclosure III. Introduction PhonerLite [1] is a freeware SIP soft phone client running on the Windows platform and supporting common VoIP features as well as security functionality such as SIP TLS, SRTP, and ZRTP. [1] http://www.phonerlite.de IV. Vulnerability Description PhonerLite SIP soft phone version 2.14 is vulnerable to revealing SIP MD5 digest authenticated user credential hash via spoofed SIP INVITE message sent by a malicious 3rd party. After responding back to an authentication challenge to the BYE message, PhonerLite leaks the hashed MD5 digest credentials. After the 3rd party receives the dumped MD5 hash, they can use this information to mount an offline wordlist attack. This SIP protocol implementation issue vulnerability was initially discovered by Sandro Gauci of Enable Security [2], with vendor soft phones and handsets showing differential success in mitigating this flaw. CVE-IDs have been reserved for two previous SIP soft phone implementations [3, 4] that were tested as vulnerable. [2] https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf [3] CVE-ID for Gizmo5 soft phone: CVE-2009-5139 [4] CVE-ID for Linksys SPA2102 adapter: CVE-2009-5140 V. Technical Description / Proof of Concept Code The following steps can be carried out in duplicating this vulnerability. Step 1: Use SIPp protocol tester to craft a SIP INVITE message using TCP transport and forward the SIP message towards the IP address of the Windows PhonerLite soft phone, listening on TCP port 5060 Step 2: PhonerLite user answers call Step 3: PhonerLite user hangs up call, since there is no one talking (it is like dead air) Step 4: Attacker receives BYE message from PhonerLite. Immediately after receiving BYE, attacker sends a 401 challenge SIP message Step 5: PhonerLite responds with a second BYE message, containing SIP Authorization header (which contains MD5 hash / response) Step 6: Attacker mounts an offline wordlist attack against the dumped MD5 hash using sipdump/sipcrack Additional Notes: * The vulnerability verification was tested as a malicious 3rd party using Kali Linux [5] distribution, with all tools included in distro. * The attacker does not need to know the correct username of PhonerLite registered SIP user. The attacker only needs to find the IP address of a PhonerLite endpoint listening on TCP port 5060. * The attacker does not need to know the digest realm field. A null realm string of "NULL" or "null" will be sufficient in exploiting the flaw. * Verified that PhonerLite is not vulnerable to this security flaw when attacker uses UDP transport instead of TCP [5] http://kali.org VIII. Vendor Information, Solutions, and Workarounds This issue is fixed in PhonerLite version 2.15 Resolution is the following, as specified by the author: A SIP UAC (User Agent Client) should not send a 401 or 407. In other words, only a UAS (User Agent Server) should send a 401 or 407 challenge. Therefore, a 401/407 will be dropped by the UAS (PhonerLite) if sent by a malicious 3rd party UAC. IX. Credits This vulnerability has been discovered by: Jason Ostrom of Stora XX. Vulnerability History Sun, 2/16/14: Vulnerability discovered Wed, 3/12/14: Sent vulnerability disclosure to Heiko Sommerfeldt, info at phoner.de Thu, 3/13/14: Notified by author that Beta version has been uploaded, which should fix problem. Attempted to verify with security testing of Beta 2.15. Verified that issue has been resolved. Sun, 3/30/14: Notified by author that fixed version (2.15) has been uploaded Sun, 3/30/14: Vulnerability disclosure posted XXI. Disclaimer The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Stora accepts no responsibility for any damage caused by the use or misuse of this information. -----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.3.2 (Build 15238) Charset: us-ascii wsBVAwUBUzl9EWRzm/FWea0uAQjX8gf/Ts6IWfPbMFeir5PxDrvQ2VWBNCESgODN GgJQZaj6339ZxIMFC6IYoD4Uvx223igSB+OyYHLmGZOnQoES7Ilj2Or5Afe71Cqe ExqYe2fTaZeyruWTgmPA296W3EEoT+Cedeyy5k0+sxK4ahKZ2DQgM/WIDDHU3X/B nAJZWob+r2f2tQr+OBhy7saMEix9QMNeAEZCa+JJ8az9gxe6+AU9kdmwj9hPy+qc ZDODMOSyvYojfuvE0oy0AyZ1OBWVpI9lSCI6wmUT6ihOpruz3OKQT+e1HyFoBvmX aafzW7VlbxgS3EQRC25EWj61BYVIy7OpIFfOzymyBnL/qb0PTBmiDA== =rmxn -----END PGP SIGNATURE----- |