#############################################################

COMPASS SECURITY ADVISORY http://www.csnc.ch/

#############################################################

Product: IP Phone

Vendor: Nortel

Subject: IP Phone forced re-authentication

Risk: High

Effect: Currently exploitable

Author: Daniel Stirnimann (daniel.stirnimann (at) csnc (dot) ch)

Date: October, 18th 2007

#############################################################

Introduction:

The UNIStim signalisation protocol is vulnerable against spoofed re-authentication messages. A
malicious user can send spoofed registration messages to the server to which a UNIStim IP phone is
connected. This can force the legitimate IP phone into a situation where it must re-register
with the server to maintain service. A continuous stream of these messages prevents the IP phone from
properly registering.

Nortel has noted this as:
Title: DoS Potential Vulnerability - UNIStim IP Phone Forced to Re-register
Number: 2007008385
http://support.nortel.com/go/main.jsp?cscat=SECUREADVISORY

Vulnerable:

Nortel IP Phone 1140E
IP Softphone 2050
and others.

See associated products on the Nortel advisory.

Vulnerability Management:

June 2007: Vulnerability found
June 2007: Nortel Security notified
October 2007: Nortel Advisory & Patches available
October 2007: Compass Security Information

Remediation:

Follow the recommended actions for the affected systems, as identified in the Nortel Advisory.

Technical Description:

A malicious user can send a resume message to the signaling server to which an IP phone is connected.
The resume message is a UNIStim UDP datagram. In order for the signaling server to detect which IP
phone wants to resume the
connection it reads the source IP address from the UDP datagram to identify the client. That means we
can send a spoofed resume UNIStim UDP datagram.

The server sends the new sequence number back to the IP phone. However, because we spoofed the above
message, we don't see the response. The effect is that, the IP phone is out of sync with the server.
During this time, the IP phone can not take on or make any calls. As soon as the IP phone realizes
that it is out of sync (watchdog timeout
expired) it will re-authenticate against the signaling server. Note that if the malicious user
continues to send spoofed resume messages
the hard phone will not be able to go online.

Reference:
http://www.csnc.ch/static/advisory/secadvisorylist.html