lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: 18 Oct 2007 12:28:43 -0000
From: daniel.stirniman@...c.ch
To: bugtraq@...urityfocus.com
Subject: Nortel IP Phone Flooding Denial of Service

#############################################################
#
# COMPASS SECURITY ADVISORY http://www.csnc.ch/
#
#############################################################
#
# Product: IP Phone
# Vendor:  Nortel
# Subject: IP Phone Flooding Denial of Service
# Risk:    High
# Effect:  Currently exploitable
# Author:  Daniel Stirnimann (daniel.stirnimann (at) csnc (dot) ch)
# Date:    October, 18th 2007
#
#############################################################

Introduction:
-------------
A malicious user who can send spoofed packets to an IP phone is able to freeze it. A potential victim does not recognize that his IP phone is offline until he tries to use it. Signs which make it obvious for the victim that his IP phone is not working are that he does not here a line peep sound when trying to make a call or that the LCD display is not updated.

The attack uses valid UNIStim "Mute / UnMute" messages which are sent to the IP phone with a spoofed server source address.

Nortel has noted this as:
Title:  Potential DoS Vulnerability - IP Phone Freeze to Offline State
Number: 2007008386
http://support.nortel.com/go/main.jsp?cscat=SECUREADVISORY

Vulnerable:
-----------
Nortel IP Phone 1140E
IP Softphone 2050
and others.

See associated products on the Nortel advisory.

Vulnerability Management:
-------------------------
June 2007:    Vulnerability found
June 2007:    Nortel Security notified
October 2007: Nortel Advisory available
October 2007: Compass Security Information

Remediation:
------------
Follow the recommended actions for the affected systems, as identified in the Nortel Advisory.

Technical Description:
----------------------
Flooding an IP phone with valid UNIStim messages freezes the IP phone. The IP phone needs to be rebooted by pulling the power cord in order to work again.

The proof-of-concept code uses "Mute / UnMute" UNIStim messages. The ID number is increased sequentially from 1 to 65535. After the packets have been sent, the phone is frozen and cannot be used. The phone does not ring if it's number is called and the LCD display is not updated.

Reference:
http://www.csnc.ch/static/advisory/secadvisorylist.html

Powered by blists - more mailing lists