[VOIPSEC] VoIP-Phones: Weakness in proccessing
art at codenomicon.com
Fri Jul 22 01:03:55 BST 2005
Sorry I could not respond to your comment earlier. You said that all
permutations are impossible to test, which is of course true, but we
have to try. Both robustness tests and fuzzers are attempting to cover
all these unexpected inputs. Fuzzers are typically semi-random,
whereas robustness tests are more advanced, systematic and "smart".
One can start with the free robustness testing techniques introduced
by PROTOS in their SIP and H.323 test-suites. I hope all vendors are
using them by now. PROTOS provides the minimum baseline for
robustness. Also that PROTOS research shows that it is not only ascii
protocols that have these problems. Actually many binary protocols
described in ASN.1 have much more serious problems due to the freedom
of being able to describe about any types of structures with it.
PROTOS tests in SIP have been continued in our company, and
Codenomicon SIP Test Tool is constantly increasing the test coverage
in SIP. From the 4500 PROTOS tests, we are already beyond 100,000 test
cases for SIP. But the number of test cases is not important, it is
the coverage of the tools. You can have millions of redundant fuzzing
test cases and still not reach the coverage of PROTOS even.
It is good to finally notice that people looking for security flaws in
SIP are going beyond the robustness testing coverage of PROTOS! It has
been quite quiet after the release of PROTOS test-suite by CERT/CC.
There is lots of work quietly being done in the commercial companies
though. For example, our company is working with our commercial
customers to fix these issues without disclosing any of the found
flaws publicly. Nobody wants public attention to SIP weaknesses, and
it is in nobodys interest for the exploits to start spreading in VoIP
scene (except perhaps that might be the interest of the hackers).
There is nothing new or special in this bug, it is just a quality
assurance flaw that should have been tested away.
PS: Update your SIP phone regularly!
On Fri, Jul 08, 2005 at 09:01:10AM -0400, Geoff Devine wrote:
> I'd point out that this kind of problem is the most glaring security
> weakness with SIP. As a completely unstructured text-based
> protocol, you can't possibly test all permutations of SIP messages.
More information about the Voipsec