The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Zyxel P2000W VoIP Wifi Phone Multiple Vulnerabilties
------------------------------------------------------------------------
SUMMARY
" <http://www.zyxel.com/product/P2000W.php> ZyXEL's P-2000W VoIP Wi-Fi
phone, compatible with IEEE 802.11b wireless standard, is a perfect
solution for Voice over IP applications."
An undocumented open port and a static DNS record allow attackers to gain
information, DoS and perform Man In the Middle attack against Zyxel's
P2000W VoIP Wifi phone.
DETAILS
Vulnerable Systems:
* Zyxel P2000W version 1 firmware version Wj.00.10
Open Port:
The Zyxel P2000W VOIP WIFI phone has an undocumented port, UDP/9090, that
provides an unauthenticated attacker information about the phone,
specifically the phone's MAC address and software version is returned upon
connection. An attacker can use this information for easily identify the
phone and software version. Also, the undocumented open port provide an
avenue for DoS.
Static DNS:
The Zyxel P2000W v.1 VOIP WIFI phone uses hard coded DNS servers located
in Taiwan for the phone's DNS configuration.
Primary DNS IP is 168.95.1.1 resolving to dns.hinet.net
Secondary DNS IP is 139.175.55.244 resolving to dns.seed.net.tw
This configuration places every ZyXel phone using this software at risk of
unintentional DoS if the DNS servers in Taiwan become unavailable. If the
DNS servers are compromised, all Zyxel phone users worldwide are
vulnerable to being redirected to malicious SIP servers, etc.
Workaround:
Users can manually input the IP address of a known, trusted DNS server via
the keyboard at each phone start when configured for DHCP or PPOE,
however, this will not persist once the phone is restarted.
ADDITIONAL INFORMATION
The information has been provided by <mailto:shawnmer@gmail.com> Shawn
Merdinger.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
