I. Description
The Session Initiation Protocol (SIP) is a developing and newly
deployed protocol that is commonly used in Voice over IP (VoIP), Internet
telephony, instant messaging, and various other applications. SIP is a
text-based protocol for initiating communication and data sessions between
users.
The Oulu University Secure Programming Group (OUSPG) previously conducted research into
vulnerabilities in LDAP, culminating in CERT Advisory
CA-2001-18, and SNMP, resulting in CERT Advisory
CA-2002-03.
OUSPG's most recent research focused on a subset of SIP related to the
INVITE message, which SIP agents and proxies are required to accept in
order to set up sessions. By applying the PROTOS
c07-sip test suite to a variety of popular SIP-enabled products, the
OUSPG discovered impacts ranging from unexpected system behavior and
denial of services to remote code execution. Note that "throttling" is an
expected behavior.
Specifications for the Session Initiation Protocol are available in
RFC3261:
http://www.ietf.org/rfc/rfc3261.txt
OUSPG has established the following site with detailed documentation
regarding SIP and the implementation test results from the test suite:
http://www.ee.oulu.fi/research/ouspg/protos/testing/c07/sip/
The IETF Charter page for SIP is available at
http://www.ietf.org/html.charters/sip-charter.html
III. Solution
Many of the mitigation steps recommended below may have significant
impact on your everyday network operations and/or network architecture.
Ensure that any changes made based on the following recommendations will
not unacceptably affect your ongoing network operations capability.
Apply a patch from your vendor
Appendix A contains information provided by
vendors for this advisory. Please consult this appendix and VU#528719 to
determine if your product is vulnerable. If a statement is unavailable,
you may need to contact your vendor directly.
Disable the SIP-enabled devices and services
As a general rule, the CERT/CC recommends disabling any service or
capability that is not explicitly required. Some of the affected products
may rely on SIP to be functional. You should carefully consider the impact
of blocking services that you may be using.
Ingress filtering
As a temporary measure, it may be possible to limit the scope of these
vulnerabilities by blocking access to SIP devices and services at the
network perimeter.
Ingress filtering manages the flow of traffic as it enters a network under
your administrative control. Servers are typically the only machines that
need to accept inbound traffic from the public Internet. Note that most
SIP User Agents (including IP phones or "“clien"t” software) consist of a
User Agent Client and a User Agent Server. In the network usage policy of
many sites, there are few reasons for external hosts to initiate inbound
traffic to machines that provide no public services. Thus, ingress
filtering should be performed at the border to prohibit externally
initiated inbound traffic to non-authorized services. For SIP, ingress
filtering of the following ports can prevent attackers outside of your
network from accessing vulnerable devices in the local network that are
not explicitly authorized to provide public SIP services:
sip 5060/udp #
Session Initiation Protocol (SIP)
sip 5060/tcp #
Session Initiation Protocol (SIP)
sip 5061/tcp #
Session Initiation Protocol (SIP) over TLS
Careful consideration should be given to addresses of the types
mentioned above by sites planning for packet filtering as part of
their mitigation strategy for these vulnerabilities.
Please note that this workaround may not protect vulnerable devices
from internal attacks.
Egress filtering
Egress filtering manages the flow of traffic as it leaves a network
under your administrative control. There is typically limited need for
machines providing public services to initiate outbound traffic to
the Internet. In the case of the SIP vulnerabilities, employing egress
filtering on the ports listed above at your network border may prevent
your network from being used as a source for attacks on other sites.
Block SIP requests directed to broadcast addresses at your
router.
Since SIP requests can be transmitted via UDP, broadcast attacks are
possible. One solution to prevent your site from being used as an
intermediary in an attack is to block SIP requests directed to broadcast
addresses at your router.
