[<prev] [next>] [day] [month] [year] [list]
Message-ID: <16056242524593b70e9a3959.48352667.Active.mail@poczta.nazwa.pl>
Date: Thu, 28 Dec 2006 13:22:38 +0100
From: sapheal@...k.pl
To: bugtraq@...urityfocus.com
Subject: OpenSER OSP Module remote code execution
Synopsis: OpenSER OSP Module remote code execution
Product: OpenSER
Version: <=1.1.0
Issue:
======
A critical security vulnerability has been found in OpenSER Open
Settlement Protocol (OSP) module. OSP is an ETSI defined standard
for Inter-Domain VoIP pricing,authorization and usage exchange.
Details:
========
int validateospheader (struct sip_msg* msg, char* ignore1, char* ignore2)
This following fuction suffers from buffer overflow vulnerability, which
leads to memory corruption conditions. Due to memory corruption conditions
remote code execution is possible.
Affected Versions
=================
OpenSER <= 1.1.0
Solution
=========
Proper boundary checking.
Exploitation
============
Exploitation might be conducted by preparing a specially crafted
OSP header.
Kind regards,
Michał Bućko - sapheal
Senior Security Specialist
HACK.PL
Powered by blists - more mailing lists