The VVoIP endpoint configuration files must not be downloaded automatically during endpoint registration.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-61319	VVoIP 1937	SV-75799r1_rule	DCBP-1 ECSC-1	Medium

Description
During VVoIP endpoint registration with the session controller, a file is downloaded by the endpoint from the session manager containing specific configuration settings. This file contains the phone number assigned to the endpoint, the IP addresses for session management, the software menus specific to the system, the endpoint configuration password, the stored personal preferences and speed dial numbers, and other system operational information. These configuration settings can be updated by resetting and re-registering the endpoint, which causes an updated configuration file to be downloaded. Automatic download of VVoIP endpoint configuration files during registration allows rogue endpoints to become part of the system. It also potentially allows human readable configuration files to be sent without encryption or digital signatures.

Description

During VVoIP endpoint registration with the session controller, a file is downloaded by the endpoint from the session manager containing specific configuration settings. This file contains the phone number assigned to the endpoint, the IP addresses for session management, the software menus specific to the system, the endpoint configuration password, the stored personal preferences and speed dial numbers, and other system operational information. These configuration settings can be updated by resetting and re-registering the endpoint, which causes an updated configuration file to be downloaded. Automatic download of VVoIP endpoint configuration files during registration allows rogue endpoints to become part of the system. It also potentially allows human readable configuration files to be sent without encryption or digital signatures.

STIG	Date
Voice Video Services Policy STIG	2018-09-19

Details

Check Text ( C-62271r1_chk )
Review site documentation to confirm the VVoIP endpoint configuration files are not downloaded automatically during endpoint registration. If VVoIP endpoint configuration files are downloaded automatically during endpoint registration, this is a finding.

Fix Text (F-67219r1_fix)
Implement and document that the VVoIP endpoint configuration files are not downloaded automatically during endpoint registration.