ShoreTel Mobility Client iOS Application - MITM SSL Certificate Vulnerability (CVE-2016-6562)

Overview

"The Mobility Client extends the enterprise desk phone features and UC capabilities to the iOS device, integrating into the PBX, enabling VoIP, Cellular, and video calling."

"aC/ Make and receive enterprise VoIP and Video calls over your office WLAN or cellular data networks"
"aC/ Maintain active calls when you walk away from a WLAN coverage area with its automatic handover of calls from WLAN to the GSM voice network"
"aC/ Automatically route international calls through your office PBX to reduce long distance charges"
"aC/ Perform directory lookups of your co-workers when you donat remember their phone number"
"aC/ Integrate with ShoreTel Communicator or ShoreTel Connect to control your mobile device through your Mac desktop"
"aC/ Access visual voice mail (ShoreTel UC systems)"
"aC/ Integrated "Today" calendar integration enables users to join ShoreTel, WebEx, and GoToMeeting conference calls with a single click"

(https://itunes.apple.com/us/app/shoretel-mobility-client/id479054518)



Issue

The ShoreTel Mobility Client iOS application (version 9.1.2.101 and below), does not validate the SSL certificate it receives when connecting to the mobile application login server.

Impact

An attacker who can perform a man in the middle attack may present a bogus SSL certificate which the application will accept silently. Usernames, passwords and sensitive information could be captured by an attacker without the user's knowledge.

Timeline

July 15, 2015 - Attempted to notify ShoreTel via security@shoretel.com, email bounced
July 15, 2015 - Resent the vulnerability details to support@shoretel.com & skysupport@shoretel.com
October 5, 2016 - Provided the vulnerability details to CERT/CC
October 17, 2016 - CERT/CC confirmed ShoreTel received the vulnerability report and are working on an updated version
January 3, 2017 - CERT/CC published vulnerability note VU#475907
Solution
The ShoreTel Mobility Client iOS application version as of January 3, 2017 (9.1.2.101) is vulnerable

CVE-ID: CVE-2016-6562

CERT/CC Report
http://www.kb.cert.org/vuls/id/475907

Questions?
http://www.info-sec.ca/contact.html