ES2021-03: VoIPmonitor is vulnerable to a buffer overflow when using the live sniffer
"Sandro Gauci" <[email protected]> Mon, 15 Mar 2021 13:48:26 +0100
| Newsgroups | gmane.comp.voip.security.voipsa,gmane.comp.security.oss.general,gmane.comp.security.bugtraq,gmane.comp.security.fulldisclosure |
|---|---|
| Message-ID | <[email protected]> |
IyBWb0lQbW9uaXRvciBpcyB2dWxuZXJhYmxlIHRvIGEgYnVmZmVyIG92ZXJmbG93IHdoZW4gdXNp bmcgdGhlIGxpdmUgc25pZmZlcgoKLSBGaXhlZCB2ZXJzaW9uczogMjcuNgotIEVuYWJsZSBTZWN1 cml0eSBBZHZpc29yeTogaHR0cHM6Ly9naXRodWIuY29tL0VuYWJsZVNlY3VyaXR5L2Fkdmlzb3Jp ZXMvdHJlZS9tYXN0ZXIvRVMyMDIxLTAzLXZvaXBtb25pdG9yLWxpdmVzbmlmZmVyLWJ1ZmZlci1v dmVyZmxvdwotIFZvSVBtb25pdG9yIFNlY3VyaXR5IEFkdmlzb3J5OiBub25lLCBjaGFuZ2Vsb2cg cmVmZXJlbmNlcyBmaXhlcyBhdCBodHRwczovL3d3dy52b2lwbW9uaXRvci5vcmcvY2hhbmdlbG9n LXNuaWZmZXIKLSBUZXN0ZWQgdnVsbmVyYWJsZSB2ZXJzaW9uczogMjcuNQotIFRpbWVsaW5lOgog ICAgLSBSZXBvcnQgZGF0ZTogMjAyMS0wMi0xMAoJLSBUcmlhZ2VkOiAyMDIxLTAyLTEyCgktIEZp eCBwcm92aWRlZCBmb3IgdGVzdGluZzogMjAyMS0wMi0xNQoJLSBWb0lQbW9uaXRvciByZWxlYXNl IHdpdGggZml4OiAyMDIxLTAyLTE1CgktIEVuYWJsZSBTZWN1cml0eSBhZHZpc29yeTogMjAyMS0w My0xNQoKIyMgRGVzY3JpcHRpb24KCkEgYnVmZmVyIG92ZXJmbG93IHdhcyBpZGVudGlmaWVkIGlu IHRoZSBWb0lQbW9uaXRvciBsaXZlIHNuaWZmZXIgZmVhdHVyZS4gVGhlIGRlc2NyaXB0aW9uIHZh cmlhYmxlIGluIHRoZSBmdW5jdGlvbiBgc2F2ZV9wYWNrZXRfc3FsYCBpcyBkZWZpbmVkIGFzIGEg Zml4ZWQgbGVuZ3RoIGFycmF5IG9mIDEwMjQgY2hhcmFjdGVycy4gVGhlIGRlc2NyaXB0aW9uIGlz IHNldCB0byB0aGUgdmFsdWUgb2YgYSBTSVAgcmVxdWVzdCBvciByZXNwb25zZSBsaW5lLiBCeSBz ZXR0aW5nIGEgbG9uZyByZXF1ZXN0IG9yIHJlc3BvbnNlIGxpbmUgVm9JUG1vbml0b3Igd2lsbCB0 cmlnZ2VyIGEgYnVmZmVyIG92ZXJmbG93LiBUaGUgYWZmZWN0ZWQgY29kZSBpczoKCmBgYGMKY2hh ciBjYWxsaWRzdHJbMTAyNF0gPSAiIjsKaWYocGFja2V0Uy0+c2lwRGF0YUxlbikgewogICAgdm9p ZCAqbWVtcHRyID0gbWVtbWVtKHBhY2tldFMtPmRhdGFfKCkrIHBhY2tldFMtPnNpcERhdGFPZmZz ZXQsIAogICAgICAgIHBhY2tldFMtPnNpcERhdGFMZW4sICJcclxuIiwgMik7CiAgICBpZihtZW1w dHIpIHsKICAgICAgICBtZW1jcHkoZGVzY3JpcHRpb24sIHBhY2tldFMtPmRhdGFfKCkrIHBhY2tl dFMtPnNpcERhdGFPZmZzZXQsIAogICAgICAgICAgICAoY2hhciAqKW1lbXB0ciAtIChjaGFyKiko cGFja2V0Uy0+ZGF0YV8oKSsgcGFja2V0Uy0+c2lwRGF0YU9mZnNldCkpOwogICAgICAgIGRlc2Ny aXB0aW9uWyhjaGFyKiltZW1wdHIgLSAoY2hhciopKHBhY2tldFMtPmRhdGFfKCkrIAogICAgICAg ICAgICBwYWNrZXRTLT5zaXBEYXRhT2Zmc2V0KV0gPSAnXDAnOwogICAgICAgIHByaW50ZigiJXNc biIsIGRlc2NyaXB0aW9uKTsKICAgIH0KICAgIC8vIC4uLgp9CmBgYAoKIyMgSW1wYWN0CgpXaGVu IHVzaW5nIHRoZSBzdGF0aWMgYmluYXJpZXMgcHJvdmlkZWQgYXQgdGhlIFZvSVBNb25pdG9yIGRv d25sb2FkIHNpdGUsIHRoaXMgdnVsbmVyYWJpbGl0eSBtYXkgbGVhZCB0byByZW1vdGUgY29kZSBl eGVjdXRpb24uIFRoaXMgaXMgZHVlIHRvIGxhY2sgb2Ygc3RhbmRhcmQgbWVtb3J5IGNvcnJ1cHRp b24gcHJvdGVjdGlvbiBhcyBleHBsYWluZWQgaW4gYSBzZXBhcmF0ZSBhZHZpc29yeSwgRVMyMDIx LTA0LXZvaXBtb25pdG9yLXN0YXRpY2J1aWxkLW1lbW9yeS1jb3JydXB0aW9uLXByb3RlY3Rpb24u CgpXaGVuIGNvbXBpbGluZyB0aGUgYHZvaXBtb25pdG9yYCBwcm9ncmFtIGZyb20gc291cmNlLCBt b3N0IG1vZGVybiBidWlsZCBzeXN0ZW1zIHdpbGwgYXV0b21hdGljYWxseSBpbmNsdWRlIHJ1bi10 aW1lIGJlc3QgcHJhY3RpY2UgY2hlY2tzLiBJbiBzdWNoIGNhc2VzLCBpdCBhcHBlYXJzIHRoYXQg dGhlIHdvcnN0LWNhc2Utc2NlbmFyaW8gaXMgdGhhdCB0aGUgcHJvZ3JhbSB3aWxsIGVuZCB1cCBj cmFzaGluZy4KCiMjIEhvdyB0byByZXByb2R1Y2UgdGhlIGlzc3VlCgoxLiBTdGFydCB0aGUgbGl2 ZSBzbmlmZmVyIGZyb20gdGhlIFZPSVBNb25pdG9yIEdVSQoyLiBFeGVjdXRlIHRoZSBmb2xsb3dp bmcgUHl0aG9uIHByb2dyYW0gc28gdGhhdCBWT0lQTW9uaXRvciBpcyBhYmxlIHRvIGNhcHR1cmUg dGhlIHBhY2tldAozLiBPYnNlcnZlIHRoYXQgVk9JUE1vbml0b3IgaGFzIGNyYXNoZWQKCmBgYHB5 dGhvbgppbXBvcnQgc29ja2V0Cm1zZz0nUkVHSVNURVIgJXMgU0lQLzIuMFxyXG4nICUgKCdhJyAq IDEwMjQpCm1zZys9J1ZpYTogU0lQLzIuMC9VRFAgMTkyLjE2OC4xLjEzMjozNTM5MztycG9ydDti cmFuY2g9ejloRzRiSy1rd3RUa3JkTkFPMld2dzB2XHJcbicKbXNnKz0nTWF4LUZvcndhcmRzOiA3 MFxyXG4nCm1zZys9J0Zyb206IDxzaXA6ODU4NjE3MTBAZGVtby5zaXB2aWNpb3VzLnBybz47dGFn PW1ucTFuS0dOWkhOVWtOT0dcclxuJwptc2crPSdUbzogPHNpcDo4NTg2MTcxMEBkZW1vLnNpcHZp Y2lvdXMucHJvPlxyXG4nCm1zZys9J0NhbGwtSUQ6IDkzWDlkTlpPMnFkY2ZwZHVcclxuJwptc2cr PSdDU2VxOiAxIFJFR0lTVEVSXHJcbicKbXNnKz0nQ29udGFjdDogPHNpcDo4NTg2MTcxMEAxOTIu MTY4LjEuMTMyOjM1MzkzO3RyYW5zcG9ydD11ZHA+XHJcbicKbXNnKz0nRXhwaXJlczogNjBcclxu Jwptc2crPSdDb250ZW50LUxlbmd0aDogMFxyXG4nCm1zZys9J1xyXG4nCgpzID0gc29ja2V0LnNv Y2tldChzb2NrZXQuQUZfSU5FVCwgc29ja2V0LlNPQ0tfREdSQU0pCnMuc2VuZHRvKG1zZy5lbmNv ZGUoKSwgKCdkZW1vLnNpcHZpY2lvdXMucHJvJywgNTA2MCkpCmBgYAoKIyMgU29sdXRpb24gYW5k IHJlY29tbWVuZGF0aW9ucwoKVG8gYWRkcmVzcyB0aGlzIGlzc3VlLCB3ZSByZWNvbW1lbmQgdXBn cmFkaW5nIHRvIHRoZSBsYXRlc3QgZml4ZWQgdmVyc2lvbiBvZiBWb0lQbW9uaXRvci4KCldlIHJl Y29tbWVuZGVkIHRoZSBmb2xsb3dpbmcgdG8gdGhlIHZlbmRvcjoKCj4gVGhlIGxlbmd0aCBvZiB0 aGUgdmFsdWUgdGhhdCB0aGUgZGVzY3JpcHRpb24gaXMgYmVpbmcgc2V0IHRvIHNob3VsZCBiZSBj aGVja2VkIGJlZm9yZSBpdCBpcyBjb3BpZWQgaW50byBtZW1vcnkuIFRoZSBwYXR0ZXJuIGBtZW1j cHkoZGVzdCwgc3JjLCBNSU4oc3JjX2xlbiwgbWF4X2xlbikpO2AgY291bGQgYmUgdXNlZCB0byBz YWZlbHkgcGVyZm9ybSB0aGlzIG9wZXJhdGlvbi4KCiMjIEFja25vd2xlZGdlbWVudHMKCkVuYWJs ZSBTZWN1cml0eSB3b3VsZCBsaWtlIHRvIHRoYW5rIE1hcnRpbiBWaXQgYW5kIHRoZSBkZXZlbG9w ZXJzIGF0IFZvSVBtb25pdG9yIGZvciB0aGUgdmVyeSBxdWljayByZXNwb25zZSBhbmQgZml4aW5n IHRoaXMgc2VjdXJpdHkgaXNzdWUuCgojIyBBYm91dCBFbmFibGUgU2VjdXJpdHkKCkVuYWJsZSBT ZWN1cml0eSBkZXZlbG9wcyBvZmZlbnNpdmUgc2VjdXJpdHkgdG9vbHMgYW5kIHByb3ZpZGVzIHF1 YWxpdHkgcGVuZXRyYXRpb24gdGVzdGluZyB0byBoZWxwIHByb3RlY3QgeW91ciByZWFsLXRpbWUg Y29tbXVuaWNhdGlvbnMgc3lzdGVtcyBhZ2FpbnN0IGF0dGFjay4KCiMjIERpc2NsYWltZXIKClRo ZSBpbmZvcm1hdGlvbiBpbiB0aGUgYWR2aXNvcnkgaXMgYmVsaWV2ZWQgdG8gYmUgYWNjdXJhdGUg YXQgdGhlIHRpbWUgb2YgcHVibGlzaGluZyBiYXNlZCBvbiBjdXJyZW50bHkgYXZhaWxhYmxlIGlu Zm9ybWF0aW9uLiBVc2Ugb2YgdGhlIGluZm9ybWF0aW9uIGNvbnN0aXR1dGVzIGFjY2VwdGFuY2Ug Zm9yIHVzZSBpbiBhbiBBUyBJUyBjb25kaXRpb24uIFRoZXJlIGFyZSBubyB3YXJyYW50aWVzIHdp dGggcmVnYXJkIHRvIHRoaXMgaW5mb3JtYXRpb24uIE5laXRoZXIgdGhlIGF1dGhvciBub3IgdGhl IHB1Ymxpc2hlciBhY2NlcHRzIGFueSBsaWFiaWxpdHkgZm9yIGFueSBkaXJlY3QsIGluZGlyZWN0 LCBvciBjb25zZXF1ZW50aWFsIGxvc3Mgb3IgZGFtYWdlIGFyaXNpbmcgZnJvbSB1c2Ugb2YsIG9y IHJlbGlhbmNlIG9uLCB0aGlzIGluZm9ybWF0aW9uLgoKIyMgRGlzY2xvc3VyZSBwb2xpY3kKClRo aXMgcmVwb3J0IGlzIHN1YmplY3QgdG8gRW5hYmxlIFNlY3VyaXR5J3MgdnVsbmVyYWJpbGl0eSBk aXNjbG9zdXJlIHBvbGljeSB3aGljaCBjYW4gYmUgZm91bmQgYXQgPGh0dHBzOi8vZ2l0aHViLmNv bS9FbmFibGVTZWN1cml0eS9WdWxuZXJhYmlsaXR5LURpc2Nsb3N1cmUtUG9saWN5Pi4KCgotLQog CiAgICBTYW5kcm8gR2F1Y2ksIENFTyBhdCBFbmFibGUgU2VjdXJpdHkgR21iSAoKICAgIFJlZ2lz dGVyIG9mIENvbXBhbmllczogICAgICAgQUcgQ2hhcmxvdHRlbmJ1cmcgSFJCIDE3MzAxNiBCCiAg ICBDb21wYW55IEhROiAgICAgICAgICAgICAgICAgICAgICAgTmV1YnVyZ2VyIFN0cmHDn2UgMTAx IGIsIDk0MDM2IFBhc3NhdSwgR2VybWFueQogICAgUEdQL0VuY3J5cHRlZCBjb21tczogICAgICAg aHR0cHM6Ly9rZXliYXNlLmlvL3NhbmRyb2dhdWNpCiAgICBPdXIgYmxvZzogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgIGh0dHBzOi8vd3d3LnJ0Y3NlYy5jb20KICAgIE90aGVyIHBvaW50 cyBvZiBjb250YWN0OiAgICAgICBodHRwczovL2VuYWJsZXNlY3VyaXR5LmNvbS8jY29udGFjdC11 cwoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KVm9pcHNl YyBtYWlsaW5nIGxpc3QKVm9pcHNlY0B2b2lwc2Eub3JnCmh0dHA6Ly92b2lwc2Eub3JnL21haWxt YW4vbGlzdGluZm8vdm9pcHNlY192b2lwc2Eub3JnCg==