<div class="description">
<p>The goal of this thesis is to investigate the security of the Session Initiation Protocol  (SIP). This was accomplished by researching previously discovered protocol and  implementation vulnerabilities, evaluating the current state of security tools and using  those tools to discover new vulnerabilities in SIP software. The CVSS v2 system was  used to score protocol and implementation vulnerabilities to give them a meaning that  was used to compare the severity of protocol vulnerabilities versus the implementation  vulnerabilities. Comparison between protocol and implementation vulnerabilities reveals  that software remains the greatest weakness of SIP.  One particular weakness is lack of TLS (secure session level) implementation in  any software tested. This remains a significant concern and leaves all of the software  tested open to many of the protocol vulnerabilities mentioned. Furthermore, the large  number of implementation vulnerabilities discovered in the parsing mechanisms while  testing software leads to the conclusion that SIP is still too immature and complex of a  protocol. More work needs to be done developing a reference implementation and robust  parser for SIP, and TLS with SIP, before SIP is ready for environments that require high  assurances of authenticity, secrecy and integrity.
</p>
<br>Subjects: Computer network protocols; Computer security; Computer networks</div>
<div class="fn value">
Dobson, Lucas E.</div>
Internet Archive identifier