CVE

Id
28826  
CVE No.
CVE-2007-5469  
Status
Candidate  
Description
** DISPUTED ** OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID (aka "toll fraud and authentication forward attack"). NOTE: Debian disputes this issue, stating that "having the two URIs mismatch is allowed by the standard and happens in some setups for valid reasons."  
Phase
Assigned (20071015)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
301751 28826 CVE-2007-5469 FULLDISC:20071012 CallManager and OpeSer toll fraud and authentication forward attack  View
301752 28826 CVE-2007-5469 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066581.html  View
301753 28826 CVE-2007-5469 FULLDISC:20071015 CallManager and OpeSer toll fraud and authentication forward attack  View
301754 28826 CVE-2007-5469 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066691.html  View
301755 28826 CVE-2007-5469 FULLDISC:20071015 CallManager and OpeSer toll fraud and authentication forward attack  View
301756 28826 CVE-2007-5469 URL:http://lists.grok.org.uk/pipermail/full-disclosure/2007-October/066694.html  View
301757 28826 CVE-2007-5469 MISC:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=446956  View
301758 28826 CVE-2007-5469 BID:26057  View
301759 28826 CVE-2007-5469 URL:http://www.securityfocus.com/bid/26057  View
301760 28826 CVE-2007-5469 SECUNIA:27204  View
301761 28826 CVE-2007-5469 URL:http://secunia.com/advisories/27204  View
301762 28826 CVE-2007-5469 XF:callmanager-openser-sip-call-hijacking(37197)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
57532 JVNDB-2007-006224 SUSE Linux Enterprise Server の ISC BIND named デーモンで使用される libgssapi におけるサービス運用妨害 (DoS) の脆弱性 SUSE Linux Enterprise Server の ISC BIND named デーモンで使用される libgssapi は、初期化エラー時に終了するため、サービス運用妨害 (デーモン終了) 状態となる脆弱性が存在します。 CVE-2007-5471 28826 7.8 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-006224.html  View