CVE-2009-5139

The SIP implementation on the Gizmo5 software phone provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue.

Score

CVSS 3.1 7.5 High

Status

Modified - cve@mitre.org

Published

2020-02-12

Last modified

2024-08-07

Weaknesses

CWE-916

Affected products

• Gizmo5 (Google)

References

• http://voipsa.org/pipermail/voipsec_voipsa.org/2009-April/002946.html
• https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf