bugtraq - RPS/APS vulnerability in snom/yealink and others

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHKQagE2qYhFEiFXTA=RqNd36Vx-qYXKBz-3j6JaRk_StAsXMA@mail.gmail.com>
Date: Wed, 23 Oct 2013 23:10:30 +0100
From: "Cal Leeming \[Simplicity Media Ltd\]" <cal.leeming@...plicitymedialtd.co.uk>
To: bugtraq <bugtraq@...urityfocus.com>
Subject: RPS/APS vulnerability in snom/yealink and others

Hello,

Discovered a vulnerability that allows for hundreds of thousands of
SIP accounts to be compromised remotely.

Found a year ago, partial vendor fixes but still vuln as of today,
disclosed a few hours ago exclusively to the FreeSWITCH community -
23rd Oct 2013.

Live disclosure can be seen here;
http://www.youtube.com/watch?v=raXkHi_uGF8

Slides are here;
https://www.dropbox.com/s/hp5fj7e7o1mdnyt/Auto%20provisioning%20sucks.pptx

Cal