VoIP Threat Advisories by Sipera VIPER Lab
Since its inception, Sipera VIPER Lab has identified thousands of potential security threats and vulnerabilities. As the details of these are discovered, the research is published as Generic Threat Advisories, which could affect numerous systems, or as Specific Threat Advisories which affect a specific device or infrastructure node. Threat Advisories are issued on an ongoing basis as a service to Sipera's customers and the general public.
Sipera VIPER Lab follows a disclosure policy which notifies equipment vendors, in advance, of Specific Threat Advisories and works with each of these vendors to publish a response, fix the vulnerability and/or identify other solutions to these security issues.
Generic Threats 
| Summary |
Type |
Date |
Severity |
System Affected |
|
Unencrypted RTP vulnerable to capture and reconstruction [more]
|
Eavesdropping |
2007.05.15 |
High |
SIP Endpoints |
|
RTCP may expose internal IP addresses and private user names across NAT device [more]
|
Privacy |
2007.05.15 |
Medium |
SIP Endpoints |
|
Weak SRTP encryption algorithm may be brute-forced to compromise confidentiality of communication [more]
|
Eavesdropping |
2007.05.15 |
Medium |
SIP Endpoints |
Specific Threats
| Summary |
Type |
Date |
Severity |
System Affected |
|
Vonage VoIP phone adapter vulnerable to server impersonation [more]
|
Spoofing |
2007.10.24 |
High |
Vonage Motorola Phone Adapter (VT 2142-VD) |
|
Vonage SIP servers vulnerable to registration replay attack [more]
|
Weak Authentication |
2007.10.24 |
Medium |
Protocol implementation in Vonage service |
|
Vonage voice conversation may be vulnerable to eavesdropping [more]
|
Eavesdropping |
2007.10.24 |
High |
Vonage Motorola Phone Adapter (VT 2142-VD) |
|
