vulnwire
5.0med

CVE-2007-5469

OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers t…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
5.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.6%
percentile 76%
Public exploits
0
none known

OpenSER 1.2.2 does not verify the Digest authentication header URI against the Request URI in SIP messages, which allows remote attackers to use sniffed Digest authentication credentials to call arbitrary telephone numbers or spoof caller ID (aka "toll fraud and authentication forward attack"). NOTE: Debian disputes this issue, stating that "having the two URIs mismatch is allowed by the standard and happens in some setups for valid reasons.

Exploit prediction (EPSS)

1.62% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.0AV:N/AC:L/Au:N/C:P/I:N/A:N

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls

References

  • secunia.com /advisories/27204 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • lists.grok.org.uk /pipermail/full-disclosure/2007-October/066581.html · mailing-list, x_refsource_FULLDISC, x_transferred
  • securityfocus.com /bid/26057 · vdb-entry, x_refsource_BID, x_transferred
  • bugs.debian.org /cgi-bin/bugreport.cgi?bug=446956 · x_refsource_MISC, x_transferred
  • lists.grok.org.uk /pipermail/full-disclosure/2007-October/066694.html · mailing-list, x_refsource_FULLDISC, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/37197 · vdb-entry, x_refsource_XF, x_transferred
  • lists.grok.org.uk /pipermail/full-disclosure/2007-October/066691.html · mailing-list, x_refsource_FULLDISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.