Avaya 4602SW SIP Phone vulnerable to server impersonation

Overview

Avaya 4602SW IP phone does not enforce server authentication using cnonce parameter during MD5 digest authentication potentially allowing an attacker to impersonate the server

Impact

An active attacker may hijack the call and compromise confidentiality of VoIP communication

Description

Avaya 4602SW can be used as a SIP-based IP phone in conjunction a SIP call server. It supports MD5 digest authentication method to authenticate itself to the server. However, it does not use cnonce parameter in Authorization header of SIP requests which leaves it vulnerable to server impersonation attacks. An active or man-in-the-middle attacker may impersonate the server and hijack communication between the un-suspecting phone and server. Attacker may then be able to listen to confidential conversations.

Solution

Phone SIP stack implementations should be patched enforce server authentication. As a best practice, TLS with mutual authentication should be used.

For more information on any of these threat advisories, please email Sipera VIPER Lab at viper@sipera.com