[ISN] SIP weakness could expose VoIP gear to attacks

Tue Feb 25 20:53:31 UTC 2003

(forwarded from ISN)

http://www.nwfusion.com/news/2003/0224sip.html

By Phil Hochmuth
Network World Fusion
02/24/03

A glitch in some vendors' Session Initiation Protocol (SIP) software
could leave SIP-enabled devices - such as IP phones, IP PBXs and
instant messaging clients - vulnerable to denial-of-service attacks,
the CERT Coordination Center said last week.

The Oulu University Secure Programming Group (OUSPG) discovered that
when a certain SIP test suite (PROTOS c07-sip) is applied to SIP
clients devices or proxy servers, it caused "impacts ranging from
unexpected system behavior and denial of services to remote code
execution," according to the CERT warning.

The vulnerably relates to the "invite" messages SIP devices send to
each other to initiate sessions such as VoIP calls, text chat or
video.

SIP is an emerging VoIP protocol used to establish sessions among SIP
"agents," such as IP phones, softphones, text chat clients, and video
applications. Industry observers have called text-based SIP the
successor to the H.323 protocol, used widely in IP-based telephony and
videoconferencing equipment. Vendors with IP PBX and phone products
that use SIP include Alcatel, Avaya, Cisco, Mitel, Nortel, Pingtel,
Ploycom, and Siemens. Microsoft Windows Messenger - a Web telephony,
chat and video client included in Windows XP - also uses SIP.

According to CERT and Cisco's Web site, Cisco's 7940 and 7960 models
of IP phones running SIP images prior to version 4.2 are vulnerable,
as well as Cisco routers running Cisco IOS 12.2T and 12.2X. PIX
firewalls running software versions with SIP support - beginning with
version 5.2(1) and up to, but not including versions 6.2(2), 6.1(4),
6.0(4) and 5.2(9) - are also affected, Cisco says. Fixes to these
products are available from Cisco's Web site.

Microsoft says its SIP-based software is not affected by the
vulnerability.

Nortel says its Succession Communication Server 2000 and Succession
Communication Server 2000 - Compact are affected by the vulnerability
only when SIP-T has been enabled on the IP PBX products. Patches for
these products are available at Nortel's Web site.

Other vendors with SIP-based products have not posted comments on the
CERT Coordination Center Web site.

-
ISN is currently hosted by Attrition.org