Secure Science Corporation Advisory TSA-053
http://www.securescience.net
e-response@xxxxxxxxxxxxxxxxx
877-570-0455
---------------------------------------------------------
Ureach.com's Uscreen Desktop software is vulnerable to misuse and enables
specific caller-id spoofing via the forward feature, enabling compromise
of other communication services operating on PSTN or wireless networks.
---------------------------------------------------------------------
Vulnerability Classification: Authentication bypass, Remote Compromise,
General misuse.
Discovery Date: October 19th, 2004
Vendor Contacted: October 27, 2004
Advisory publication date: November 5th, 2004
Vendor Description:
-------------------
uReach.com strives to provide solutions that meet a wide range of customer needs
from point solutions that address a specific need to robust bundles that can
simplify managing all forms of communications - email, voice mail, fax,
reminders, alerts and phone calls.
Abstract:
---------
Ureach.com's Uscreen Desktop is included in many services that Ureach.com
provides. It is used as a desktop alert and control service, enabling users to
identify the caller, forward the calls to arbitrary numbers, send to voicemail,
and call back missed calls. Ureach.com provides 1-800 virtual numbers to their
customers that will forward to numbers selected by the customer. Example Case:
Many VOIP phone networks allow the use of toll-free calling (18xxx) (such as
freeworld dialup and sipphone.com) and provide you with a sip id or number.
In most cases, the sip id is not the same format as the Caller-Id given on
a PSTN network (usually 7 or 10 digit sets), e.g. freeworld provides 5 or 6
digit
numbers instead. When calling a ureach number with a sip-phone that does
not match the criteria of proper caller id format, Ureach will correct it
by calling the destination number using the Caller-id display of the
destination number.
Description:
------------
In Pseudocode:
if (UscreenReceiveCall(!PROPERCIDFORMAT)) { cid = destination_target;
ForwardCall(cid, destination_target); }
By sending a non-proper formatted id as identification, the target number is
displayed as the caller. This allows for trivial abuse by arbitrary attackers,
including remote compromise of voicemail systems such as T-mobile Wireless and
Verizon Northwest (refer to Secure Science Corporation Advisory TSA-051).
Tested Vendors:
---------------
Ureach.com
Vendor and Patch Information:
-----------------------------
Secure Science Corporation has made attempts to contact the vendor and has
received no response.
Solution:
---------
Ureach.com receives calls with Caller ID signal first, ANI second (if
Caller-ID is blocked): If the Caller-ID does not match proper format, then ANI
should be utilized or the customers 877 virtual number should be displayed to
the destination.
Credits:
--------
Secure Science Corporation: Lance James
Disclaimer:
-----------
Secure Science Corporation is not responsible for the misuse of any of the
information we provide on this website and/or through our security advisories.
Our advisories are a service to our customers intended to promote secure
installation and use of Secure Science Corporation products.Attachment:
signature.asc
Description: OpenPGP digital signature