sipd is "a high performance, scalable SIP (Session Initiation Protocol) proxy and location server written in C". A format string vulnerability in the product allows remote attackers to cause the server to execute arbitrary code by providing it with a specially crafted SIP request.
Credit:
SecurITeam would like to thank STORM for finding this vulnerability.
The program incorrectly calls sapi_saprintf without any parameters: /* Request URI */
tmp = msg_url_str(req->request->url);
sapi_saprintf(&hkey, tmp);
sapi_free(tmp);
This means that a URI that includes format strings can cause the remote server to execute arbitrary code due to insufficient formatting being passed to the printf() function.
my $socket = IO::Socket::INET->new(Proto => "udp") or die "Socket error: $@\n";
my $ipaddr = inet_aton($remote_host) || $remote_host;
my $portaddr = sockaddr_in($port, $ipaddr);
send($socket, $buf, 0, $portaddr) == length($buf) or die "Can't send: $!\n";
