ShoreTel Mobility Client iOS Application - MITM SSL Certificate Vulnerability (CVE-2016-6562)
"The Mobility Client extends the enterprise desk phone features and UC capabilities to the iOS device, integrating into the PBX, enabling VoIP, Cellular, and video calling."
"• Make and receive enterprise VoIP and Video calls over your office WLAN or cellular data networks"
"• Maintain active calls when you walk away from a WLAN coverage area with its automatic handover of calls from WLAN to the GSM voice network"
"• Automatically route international calls through your office PBX to reduce long distance charges"
"• Perform directory lookups of your co-workers when you don‘t remember their phone number"
"• Integrate with ShoreTel Communicator or ShoreTel Connect to control your mobile device through your Mac desktop"
"• Access visual voice mail (ShoreTel UC systems)"
"• Integrated "Today" calendar integration enables users to join ShoreTel, WebEx, and GoToMeeting conference calls with a single click"
The ShoreTel Mobility Client iOS application (version 220.127.116.11 and below), does not validate the SSL certificate it receives when connecting to the mobile application login server.
An attacker who can perform a man in the middle attack may present a bogus SSL certificate which the application will accept silently.
Usernames, passwords and sensitive information could be captured by an attacker without the user's knowledge.
July 15, 2015 - Attempted to notify ShoreTel via email@example.com, email bounced
July 15, 2015 - Resent the vulnerability details to firstname.lastname@example.org & email@example.com
October 5, 2016 - Provided the vulnerability details to CERT/CC
October 17, 2016 - CERT/CC confirmed ShoreTel received the vulnerability report and are working on an updated version
January 3, 2017 - CERT/CC published vulnerability note VU#475907
The ShoreTel Mobility Client iOS application version as of January 3, 2017 (18.104.22.168) is vulnerable
On February 1, 2017 ShoreTel released version 22.214.171.124 which resolves this vulnerability