Subject: [sipcore] publication of security exploits

From: Victor Pascual Avila <[email-masked]>
Date: Tue, 17 Nov 2009 10:56:23 +0100

Hi,

Few months ago we submitted a document describing the SIP digest
authentication relay attack [1]. We'd also like to describe how
TCP-based SIP deployments might be vulnerable to the TCP RST attack
[2]. We haven't nailed all the details down yet, but an attacker with
spoofed source IP address could reset existing TCP connections. This
attack is hard under normal circumstances because you need to know the
IP addresses and port numbers. However, it is easy to get this
information in SIP; for instance, you just need to send a SIP message
to the UA and it will tell you its IP and port in Contact.
Having this information in hand, the attacker could reset the TCP
connection, rendering the UA unreachable until it realizes it (which
can take minutes). In a sense it is similar to the digest security
problem, the attack is well known and SIP makes it somewhat simpler to
execute.

I'd like to explicitly ask the group whether there is interest in
publishing security exploits.

[1] http://tools.ietf.org/html/draft-state-sip-relay-attack-00
[2] http://kerneltrap.org/node/3072

Cheers,
-- 
Victor Pascual Ávila