Nortel IP Phone Surveillance Mode

Advisory Content :

#############################################################

#

# COMPASS SECURITY ADVISORY http://www.csnc.ch/

#

#############################################################

#

# Product: IP Phone

# Vendor: Nortel

# Subject: IP Phone Surveillance Mode

# Risk: High

# Effect: Currently exploitable

# Author: Daniel Stirnimann (daniel.stirnimann (at) csnc (dot) ch)

# Date: October, 18th 2007

#

#############################################################

Introduction:

-------------

An IP phone can be put into surveillance mode if the correct UNIStim
message is sent to the IP phone. The UNIStim message ID must match the
expected ID between the signaling server and the IP phone. The protocol
uses only 16bit for the ID number. If a malicious user sends 65536 spoofed
UNIStim message with all possible ID numbers he is able to successfully
launch this attack.

Nortel has noted this as:

Title: UNIStim IP Phone Remote Eavesdrop Potential Vulnerability

Number: 2007008383

http://support.nortel.com/go/main.jsp?cscat=SECUREADVISORY

Vulnerable:

-----------

Nortel IP Phone 1140E

IP Softphone 2050

and others.

See associated products on the Nortel advisory.

Vulnerability Management:

-------------------------

June 2007: Vulnerability found

June 2007: Nortel Security notified

October 2007: Nortel Advisory & Patches available

October 2007: Compass Security Information

Remediation:

------------

Follow the recommended actions for the affected systems, as identified in
the Nortel Advisory.

Technical Description:

----------------------

A malicious user sends n spoofed "Open Audio Stream" messages to an IP
phone which it intents to put into surveillance mode. If the ID of the
message matches the ID number between the signaling server and the IP
phone, the message is accepted and the audio stream is opened to the host
given in the "Open Audio Stream" message.

To increase the probability of exploiting this vulnerability the number of
spoofed messages need to be as close as possible to the maximum. The RUDP
datagram uses a 32bit field for the ID number. However, the implementation
of Nortel makes only use of 16bit. That means if we send 65536 messages
with different IDs we will hit the correct ID by 100%. However, there is a
small catch, if the number of spoofed messages is too high, the IP phone
will crash and a manual reboot is required to bring it back online.

Reference:

http://www.csnc.ch/static/advisory/secadvisorylist.html

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Nortel IP Phone Surveillance Mode