CVE-2007-5469 — MEDIUM (5.0)

Vulnerability Description

OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID (aka "toll fraud and authentication forward attack"). NOTE: Debian disputes this issue, stating that "having the two URIs mismatch is allowed by the standard and happens in some setups for valid reasons.

CVSS Score

5.0

MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Openser	Openser	1.2.2

Related Weaknesses (CWE)

CWE-264

References

FAQ

What is CVE-2007-5469?

CVE-2007-5469 is a vulnerability with a CVSS score of 5.0 (MEDIUM). OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbit...

How severe is CVE-2007-5469?

CVE-2007-5469 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2007-5469?

Check the references section above for vendor advisories and patch information. Affected products include: Openser Openser.