sipdroid SIP INVITE Response User Enumeration Weakness

Bugtraq ID:	47710
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	May 04 2011 12:00AM
Updated:	May 04 2011 12:00AM
Credit:	Anibal Vaz Marques de Aguiar
Vulnerable:	sipdroid sipdroid 2.2 sipdroid sipdroid 2.0.1 sipdroid sipdroid 1.6.1
Not Vulnerable:

sipdroid SIP INVITE Response User Enumeration Weakness

sipdroid is prone to a user-enumeration weakness.

An attacker may leverage this issue to harvest valid usernames, which may aid in brute-force attacks.

sipdroid 1.6.1, 2.0.1, and 2.2 running on Android 2.1 are vulnerable; other versions may also be affected.

sipdroid SIP INVITE Response User Enumeration Weakness

An attacker can exploit this issue by supplying the application with INVITE requests.

The following exploit code is available:

• /data/vulnerabilities/exploits/47710.py

sipdroid SIP INVITE Response User Enumeration Weakness

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

sipdroid SIP INVITE Response User Enumeration Weakness

References:

• sipdroid Homepage (sipdroid)
  
• SIPDroid user/extension enum (Anibal Aguiar )