ed0e1e4d44
1979 changes to exploits/shellcodes Couchdb 1.5.0 - 'uuids' Denial of Service Apache CouchDB 1.5.0 - 'uuids' Denial of Service Beyond Remote 2.2.5.3 - Denial of Service (PoC) udisks2 2.8.0 - Denial of Service (PoC) Termite 3.4 - Denial of Service (PoC) SoftX FTP Client 3.3 - Denial of Service (PoC) Silverstripe 2.3.5 - Cross-Site Request Forgery / Open redirection SilverStripe CMS 2.3.5 - Cross-Site Request Forgery / Open Redirection Silverstripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - Multiple Vulnerabilities Silverstripe CMS 2.4 - File Renaming Security Bypass SilverStripe CMS 2.4 - File Renaming Security Bypass Silverstripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities SilverStripe CMS 2.4.5 - Multiple Cross-Site Scripting Vulnerabilities Silverstripe CMS 2.4.7 - 'install.php' PHP Code Injection SilverStripe CMS 2.4.7 - 'install.php' PHP Code Injection Silverstripe Pixlr Image Editor - 'upload.php' Arbitrary File Upload SilverStripe CMS Pixlr Image Editor - 'upload.php' Arbitrary File Upload Silverstripe CMS 2.4.x - 'BackURL' Open Redirection SilverStripe CMS 2.4.x - 'BackURL' Open Redirection Silverstripe CMS - 'MemberLoginForm.php' Information Disclosure SilverStripe CMS - 'MemberLoginForm.php' Information Disclosure Silverstripe CMS - Multiple HTML Injection Vulnerabilities SilverStripe CMS - Multiple HTML Injection Vulnerabilities Apache CouchDB 1.7.0 and 2.x before 2.1.1 - Remote Privilege Escalation Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation Monstra CMS before 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (2) Monstra CMS < 3.0.4 - Cross-Site Scripting Monstra CMS < 3.0.4 - Cross-Site Scripting (1) Navigate CMS 2.8 - Cross-Site Scripting Collectric CMU 1.0 - 'lang' SQL injection Joomla! Component CW Article Attachments 1.0.6 - 'id' SQL Injection LG SuperSign EZ CMS 2.5 - Remote Code Execution MyBB Visual Editor 1.8.18 - Cross-Site Scripting Joomla! Component AMGallery 1.2.3 - 'filter_category_id' SQL Injection Joomla! Component Micro Deal Factory 2.4.0 - 'id' SQL Injection RICOH Aficio MP 301 Printer - Cross-Site Scripting Joomla! Component Auction Factory 4.5.5 - 'filter_order' SQL Injection RICOH MP C6003 Printer - Cross-Site Scripting Linux/ARM - Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (28 Bytes) Linux/ARM - sigaction() Based Egghunter (PWN!) + execve(_/bin/sh__ NULL_ NULL) Shellcode (52 Bytes)
72 lines
No EOL
3.4 KiB
Text
72 lines
No EOL
3.4 KiB
Text
census ID: census-2016-0009
|
||
CVE ID: CVE-2016-2385
|
||
Affected Products: Kamailio 4.3.4 (and possibly previous versions)
|
||
Class: Heap-based Buffer Overflow (CWE-122)
|
||
Remote: Yes
|
||
Discovered by: Stelios Tsampas
|
||
Kamailio (successor of former OpenSER and SER) is an Open Source SIP Server released under GPL, able to handle thousands of call setups per second. Kamailio can be used to build large platforms for VoIP and realtime communications, presence, WebRTC, Instant messaging and other applications. It can also easily be applied to scaling up SIP-to-PSTN gateways, PBX systems or media servers.
|
||
|
||
There is a (remotely exploitable) heap overflow vulnerability in Kamailio version 4.3.4 and possibly in previous versions. The vulnerability takes place in the SEAS module, which enables Kamailio to transfer the execution logic control of a SIP message to a given external entity, called the Application Server.
|
||
|
||
Details
|
||
|
||
The heap overflow can be triggered if Kamailio is configured to use the SEAS module, more specifically if Kamailio calls the module’s single exported function as_relay_t(). The heap overflow is located in function encode_msg(), file encode_msg.c, line 269:
|
||
|
||
|
||
int encode_msg(struct sip_msg *msg, char *payload,int len)
|
||
{
|
||
...
|
||
/*now we copy the actual message after the headers-meta-section*/
|
||
memcpy(&payload[j],msg->buf,msg->len);
|
||
LM_DBG("msglen = %d,msg starts at %d\n",msg->len,j);
|
||
j=htons(j);
|
||
...
|
||
}
|
||
|
||
msg is a pointer to a sip_msg structure and it is basically the current SIP packet being processed by Kamailio. msg->buf is a buffer which holds the packet's contents and msg->len is the packet's length. Unsurprisingly, msg->len can take arbitrary values (bound by the packet size) while j takes the value of 180 in most cases.
|
||
|
||
The destination buffer payload is allocated in encoded_msg()'s caller function, create_as_event_t(), specifically in file seas.c, line 442:
|
||
|
||
|
||
char * create_as_event_t(struct cell *t, struct sip_msg *msg, char processor_id,
|
||
int *evt_len, int flags)
|
||
{
|
||
...
|
||
if(!(buffer=shm_malloc(ENCODED_MSG_SIZE))){
|
||
LM_ERR("Out Of Memory !!\n");
|
||
return 0;
|
||
}
|
||
...
|
||
if(encode_msg(msg,buffer+k,ENCODED_MSG_SIZE-k)<0){
|
||
LM_ERR("Unable to encode msg\n");
|
||
goto error;
|
||
}
|
||
...
|
||
}
|
||
|
||
Preprocessor constant ENCODE_MSG_SIZE is defined as 3200 and variable k at line 521 holds the value 34. The problem is that the program does not check the packet's length if it is larger than the destination buffer. If a user makes a request with a large enough packet then the buffer will overflow.
|
||
|
||
Discussion
|
||
|
||
We were able to trigger the bug remotely using a large UDP packet.
|
||
|
||
A proof-of-concept packet is provided below that crashes the Kamailio process handling the request. From bash the packet can be sent using the following command:
|
||
|
||
|
||
cat seas-trigger.packet > /dev/udp/KAMAILIO-IP/KAMAILIO-PORT
|
||
|
||
This bug may potentially provide attackers with remote code execution capabilities.
|
||
|
||
Recommendation
|
||
|
||
The security defect has been fixed in version 4.3.5 of Kamailio. Upgrading to the latest stable version is strongly advised.
|
||
Disclosure Timeline
|
||
|
||
Vendor Contact: February 12th, 2016
|
||
CVE assignment: February 15th, 2016
|
||
Vendor Patch Release: March 3rd, 2016
|
||
Public Advisory: March 30th, 2016
|
||
|
||
Proof of Concept:
|
||
https://census-labs.com/media/seas-trigger.packet
|
||
https://github.com/offensive-security/exploitdb-bin-sploits/raw/master/bin-sploits/39638.zip |