" E. g. a standard asterisk SIP-Proxy will always reply with a "SIP/2.0 401 Unauthorized", also submitting a digest and a realm value. The client then has to authenticate using a response value which is normally a MD5 Hash consisting of Username, Password, nonce, HTTP Request Method and Request URI. "

None of this seems to have any entropy. Which means it's vulnerable to replay attacks, just as the article states.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/infocus/1862/512#512