Critical Remote Hacking Flaws Disclosed in Linphone and MicroSIP Softphones

guest · Oct 14, 2021

Critical Remote Hacking Flaws Disclosed in Linphone and MicroSIP Softphones
October 14, 2021
https://thehackernews.com/2021/10/critical-remote-hacking-flaws-disclosed.html

Multiple security vulnerabilities have been disclosed in softphone software from Linphone and MicroSIP that could be exploited by an unauthenticated remote adversary to crash the client and even extract sensitive information like password hashes by simply making a malicious call.

The vulnerabilities, which were discovered by Moritz Abrell of German pen-testing firm SySS GmbH, have since been addressed by the respective manufacturers following responsible disclosure.
Click to expand...

SIP aka Session Initiation Protocol is a signaling protocol that's used to control interactive communication sessions, such as voice, video, chat and instant messaging, as well as games and virtual reality, between endpoints, in addition to defining rules that govern the establishment and termination of each session.
Click to expand...

The attack devised by SySS is what's called a SIP Digest Leak, which involves sending a SIP INVITE message to the target softphone to negotiate a session followed by sending a "407 proxy authentication required" HTTP response status code, indicating the inability to complete the request because of a lack of valid authentication credentials, prompting the softphone to respond back with the necessary authentication data.

"With this information, the attacker is able to perform an offline password guessing attack, and, if the guessing attack is successful, obtain the plaintext password of the targeted SIP account," Abrell explained. "Therefore, this vulnerability in combination with weak passwords is a significant security issue."
Click to expand...

Also discovered is a NULL pointer dereference vulnerability in the Linphone SIP stack that could be triggered by an unauthenticated remote attacker by sending a specially crafted SIP INVITE request that could crash the softphone.

"A missing tag parameter in the From header causes a crash of the SIP stack of Linphone," Abrell said.
Click to expand...

Log in or Sign up

Critical Remote Hacking Flaws Disclosed in Linphone and MicroSIP Softphones

guest Guest

Log in or Sign up

Critical Remote Hacking Flaws Disclosed in Linphone and MicroSIP Softphones

guest Guest

Useful Searches