PT-2007-6505 · Openser · Openser

Nico Golde · Published 2007-10-16 · Updated 2024-08-07 · CVE-2007-5469

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: OpenSER version 1.2.2

Description: The issue allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID, which can lead to toll fraud and authentication forward attacks. This occurs because OpenSER does not verify the Digest authentication header URI against the Request URI in SIP messages. Note that Debian disputes this issue, stating that having the two URIs mismatch is allowed by the standard and happens in some setups for valid reasons.

Recommendations: For OpenSER version 1.2.2, consider implementing additional authentication measures or restrictions to prevent unauthorized access and mitigate the risk of toll fraud and authentication forward attacks. As a temporary workaround, consider restricting access to sensitive SIP messages or implementing additional validation checks for Digest authentication credentials.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2007-5469

Affected Products

Openser

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2007-5469 · Security Note
• http://secunia.com/advisories/27204 · Vendor Advisory
• http://securityfocus.com/bid/26057 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066691.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/37197 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066581.html · Note
• https://t.me/cvenotify/89728 · Telegram Post
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446956 · Note
• http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066694.html · Note