The Session Border Controller (SBC) must be configured to validate the structure and validity of SIP and AS-SIP messages so that malformed messages or messages containing errors are dropped before action is taken on the contents.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259931	SRG-VOIP-000510	SV-259931r948777_rule		Low

Description
Malformed SIP and AS_SIP messages, as well as messages containing errors, could be an indication that an adversary is attempting some form of attack or denial of service. Such an attack is called fuzzing. Fuzzing is the deliberate sending of signaling messages that contain errors in an attempt to cause the target device to react in an inappropriate manner, such as failure that causes a denial of service or permitting traffic to pass that it would not normally permit. In some cases, a target can be flooded with fuzzed messages. The SBC must not act on any portion of a signaling message that contains errors. A malformed or erroneous message could be sent by the signaling partner and be properly hashed for integrity.

Description

Malformed SIP and AS_SIP messages, as well as messages containing errors, could be an indication that an adversary is attempting some form of attack or denial of service. Such an attack is called fuzzing. Fuzzing is the deliberate sending of signaling messages that contain errors in an attempt to cause the target device to react in an inappropriate manner, such as failure that causes a denial of service or permitting traffic to pass that it would not normally permit. In some cases, a target can be flooded with fuzzed messages. The SBC must not act on any portion of a signaling message that contains errors. A malformed or erroneous message could be sent by the signaling partner and be properly hashed for integrity.

STIG	Date
Enterprise Voice, Video, and Messaging Policy Security Requirements Guide	2024-03-12

Details

Check Text ( C-63662r946712_chk )
Verify the DISN NIPRNet IPVS SBC is configured to validate the structure and validity of SIP and AS-SIP messages so that malformed messages or messages containing errors are dropped before action is taken on the contents. If the SBC does not validate the correct format of the received AS-SIP message, this is a finding. NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from cloud service providers.

Check Text ( C-63662r946712_chk )

Verify the DISN NIPRNet IPVS SBC is configured to validate the structure and validity of SIP and AS-SIP messages so that malformed messages or messages containing errors are dropped before action is taken on the contents.

If the SBC does not validate the correct format of the received AS-SIP message, this is a finding.

NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from cloud service providers.

Fix Text (F-63569r946713_fix)
Ensure the DISN NIPRNet IPVS SBC is configured to validate the structure and validity of SIP and AS-SIP messages so that malformed messages or messages containing errors are dropped before action is taken on its contents. NOTE: The VVoIP system may allow SIP and SRTP traffic encrypted and encapsulated on port 443 from cloud service providers.