Nortel IP Phone forced re-authentication

[daniel.stirnimann () csnc ch]

#############################################################
#
# COMPASS SECURITY ADVISORY http://www.csnc.ch/
#
#############################################################
#
# Product: IP Phone
# Vendor:  Nortel
# Subject: IP Phone forced re-authentication
# Risk:    High
# Effect:  Currently exploitable
# Author:  Daniel Stirnimann (daniel.stirnimann (at) csnc (dot) ch)
# Date:    October, 18th 2007
#
#############################################################

Introduction:
-------------
The UNIStim signalisation protocol is vulnerable against spoofed re-authentication messages. A malicious user can send 
spoofed registration messages to the server to which a UNIStim IP phone is connected. This can force the legitimate IP 
phone into a situation where it must re-register
with the server to maintain service. A continuous stream of these messages prevents the IP phone from properly 
registering.

Nortel has noted this as:
Title:  DoS Potential Vulnerability - UNIStim IP Phone Forced to Re-register
Number: 2007008385
http://support.nortel.com/go/main.jsp?cscat=SECUREADVISORY

Vulnerable:
-----------
Nortel IP Phone 1140E
IP Softphone 2050
and others.

See associated products on the Nortel advisory.

Vulnerability Management:
-------------------------
June 2007:    Vulnerability found
June 2007:    Nortel Security notified
October 2007: Nortel Advisory & Patches available
October 2007: Compass Security Information

Remediation:
------------
Follow the recommended actions for the affected systems, as identified in the Nortel Advisory.

Technical Description:
----------------------
A malicious user can send a resume message to the signaling server to which an IP phone is connected. The resume 
message is a UNIStim UDP datagram. In order for the signaling server to detect which IP phone wants to resume the
connection it reads the source IP address from the UDP datagram to identify the client. That means we can send a 
spoofed resume UNIStim UDP datagram.

The server sends the new sequence number back to the IP phone. However, because we spoofed the above message, we don't 
see the response. The effect is that, the IP phone is out of sync with the server. During this time, the IP phone can 
not take on or make any calls. As soon as the IP phone realizes that it is out of sync (watchdog timeout
expired) it will re-authenticate against the signaling server. Note that if the malicious user continues to send 
spoofed resume messages
the hard phone will not be able to go online.

Reference:
http://www.csnc.ch/static/advisory/secadvisorylist.html