SIP: Server Response - Unauthorized (401)
This signature detects attempts to exploit a known vulnerability against Session Initiation Protocol (SIP). Detecting a SIP server response of 401, Unauthorized, can indicate a client can be incorrectly configured or can have requested a feature which requires authorization. This can be a common occurrence in a SIP network, but when combined with other event logs, might be an indication of malicious activity.
References
Short Name
VOIP:SIP:SRV-RESP-401
Severity
Info
Recommended
False
Recommended Action
None
Category
VOIP
Keywords
(401) - Response Server Unauthorized
Release Date
05/24/2006
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3375
False Positive
Rarely