PhonerLite 2.14 SIP Soft Phone - SIP Digest Disclosure

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA256



I. Advisory Summary



Title: SIP Digest Leak Information Disclosure in PhonerLite 2.14 SIP Soft Phone

Date Published: March 30, 2014

Vendors contacted: Heiko Sommerfeldt, PhonerLite author

Discovered by: Jason Ostrom

Severity: Medium



II. Vulnerability Scoring Metrics



CVE Reference: CVE-2014-2560

CVSS v2 Base Score: 4.3

CVSS v2 Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Component(s): PhonerLite SIP Soft Phone

Class: Information Disclosure



III. Introduction



PhonerLite [1] is a freeware SIP soft phone client running on the Windows

platform and supporting common VoIP features as well as security

functionality such as SIP TLS, SRTP, and ZRTP.



[1] http://www.phonerlite.de



IV. Vulnerability Description



PhonerLite SIP soft phone version 2.14 is vulnerable to revealing SIP MD5

digest authenticated user credential hash via spoofed SIP INVITE message

sent by a malicious 3rd party. After responding back to an authentication

challenge to the BYE message, PhonerLite leaks the hashed MD5 digest

credentials. After the 3rd party receives the dumped MD5 hash, they can use

this information to mount an offline wordlist attack. This SIP protocol

implementation issue vulnerability was initially discovered by Sandro Gauci

of Enable Security [2], with vendor soft phones and handsets showing

differential success in mitigating this flaw. CVE-IDs have been reserved

for two previous SIP soft phone implementations [3, 4] that were tested as

vulnerable.



[2] https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf

[3] CVE-ID for Gizmo5 soft phone: CVE-2009-5139

[4] CVE-ID for Linksys SPA2102 adapter: CVE-2009-5140



V. Technical Description / Proof of Concept Code



The following steps can be carried out in duplicating this vulnerability.



Step 1:

Use SIPp protocol tester to craft a SIP INVITE message using TCP transport

and forward the SIP message towards the IP address of the Windows PhonerLite

soft phone, listening on TCP port 5060

Step 2:

PhonerLite user answers call

Step 3:

PhonerLite user hangs up call, since there is no one talking (it is like

dead air)

Step 4:

Attacker receives BYE message from PhonerLite. Immediately after receiving

BYE, attacker sends a 401 challenge SIP message

Step 5:

PhonerLite responds with a second BYE message, containing SIP Authorization

header (which contains MD5 hash / response)

Step 6:

Attacker mounts an offline wordlist attack against the dumped MD5 hash using

sipdump/sipcrack



Additional Notes:

* The vulnerability verification was tested as a malicious 3rd party using

Kali Linux [5] distribution, with all tools included in distro.

* The attacker does not need to know the correct username of PhonerLite

registered SIP user. The attacker only needs to find the IP address of a

PhonerLite endpoint listening on TCP port 5060.

* The attacker does not need to know the digest realm field. A null realm

string of "NULL" or "null" will be sufficient in exploiting the flaw.

* Verified that PhonerLite is not vulnerable to this security flaw when

attacker uses UDP transport instead of TCP



[5] http://kali.org



VIII. Vendor Information, Solutions, and Workarounds



This issue is fixed in PhonerLite version 2.15



Resolution is the following, as specified by the author: A SIP UAC (User

Agent Client) should not send a 401 or 407. In other words, only a UAS

(User Agent Server) should send a 401 or 407 challenge. Therefore, a

401/407 will be dropped by the UAS (PhonerLite) if sent by a malicious 3rd

party UAC.



IX. Credits



This vulnerability has been discovered by:

Jason Ostrom of Stora



XX. Vulnerability History



Sun, 2/16/14: Vulnerability discovered

Wed, 3/12/14: Sent vulnerability disclosure to Heiko Sommerfeldt, info at

phoner.de

Thu, 3/13/14: Notified by author that Beta version has been uploaded, which

should fix problem. Attempted to verify with security testing of Beta 2.15.

Verified that issue has been resolved.

Sun, 3/30/14: Notified by author that fixed version (2.15) has been

uploaded

Sun, 3/30/14: Vulnerability disclosure posted



XXI. Disclaimer



The information contained within this advisory is supplied "as-is" with no

warranties or guarantees of fitness of use or otherwise. Stora accepts no

responsibility for any damage caused by the use or misuse of this

information.



-----BEGIN PGP SIGNATURE-----

Version: Encryption Desktop 10.3.2 (Build 15238)

Charset: us-ascii



wsBVAwUBUzl9EWRzm/FWea0uAQjX8gf/Ts6IWfPbMFeir5PxDrvQ2VWBNCESgODN

GgJQZaj6339ZxIMFC6IYoD4Uvx223igSB+OyYHLmGZOnQoES7Ilj2Or5Afe71Cqe

ExqYe2fTaZeyruWTgmPA296W3EEoT+Cedeyy5k0+sxK4ahKZ2DQgM/WIDDHU3X/B

nAJZWob+r2f2tQr+OBhy7saMEix9QMNeAEZCa+JJ8az9gxe6+AU9kdmwj9hPy+qc

ZDODMOSyvYojfuvE0oy0AyZ1OBWVpI9lSCI6wmUT6ihOpruz3OKQT+e1HyFoBvmX

aafzW7VlbxgS3EQRC25EWj61BYVIy7OpIFfOzymyBnL/qb0PTBmiDA==

=rmxn

-----END PGP SIGNATURE-----