Description
Cisco CallManager 5.1.1.3000-5 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID (aka "toll fraud and authentication forward attack").
References
- 20071012 CallManager and OpeSer toll fraud and authentication forward attack mailing-list
- ADV-2007-3534 vdb-entry
- 27231 third-party-advisory
- 26057 vdb-entry
- 20071015 CallManager and OpeSer toll fraud and authentication forward attack mailing-list
- callmanager-openser-sip-call-hijacking(37197) vdb-entry
- 20071015 CallManager and OpeSer toll fraud and authentication forward attack mailing-list