ES2021-04: VoIPmonitor static builds are c ompiled without any standard memory corruption protection

"Sandro Gauci" <[email protected]> Mon, 15 Mar 2021 13:50:26 +0100
Newsgroups gmane.comp.voip.security.voipsa,gmane.comp.security.oss.general,gmane.comp.security.bugtraq,gmane.comp.security.fulldisclosure
Message-ID <[email protected]>
IyBWb0lQbW9uaXRvciBzdGF0aWMgYnVpbGRzIGFyZSBjb21waWxlZCB3aXRob3V0IGFueSBzdGFu
ZGFyZCBtZW1vcnkgY29ycnVwdGlvbiBwcm90ZWN0aW9uCgotIEZpeGVkIHZlcnNpb25zOiBOL0EK
LSBFbmFibGUgU2VjdXJpdHkgQWR2aXNvcnk6IGh0dHBzOi8vZ2l0aHViLmNvbS9FbmFibGVTZWN1
cml0eS9hZHZpc29yaWVzL3RyZWUvbWFzdGVyL0VTMjAyMS0wNC12b2lwbW9uaXRvci1zdGF0aWNi
dWlsZC1tZW1vcnktY29ycnVwdGlvbi1wcm90ZWN0aW9uCi0gVm9JUG1vbml0b3IgU2VjdXJpdHkg
QWR2aXNvcnk6IG5vbmUKLSBUZXN0ZWQgdnVsbmVyYWJsZSB2ZXJzaW9uczogMjcuNQotIFRpbWVs
aW5lOgogICAgLSBSZXBvcnQgZGF0ZTogMjAyMS0wMi0xMCAmIDIwMjEtMDItMTMKCS0gRW5hYmxl
IFNlY3VyaXR5IGFkdmlzb3J5OiAyMDIxLTAzLTE1CgojIyBEZXNjcmlwdGlvbgoKVGhlIGJpbmFy
aWVzIGF2YWlsYWJsZSBmb3IgZG93bmxvYWQgYXQgPGh0dHBzOi8vd3d3LnZvaXBtb25pdG9yLm9y
Zy9kb3dubG9hZD4gYXJlIGJ1aWx0IHdpdGhvdXQgYW55IG1lbW9yeSBjb3JydXB0aW9uIHByb3Rl
Y3Rpb24gaW4gcGxhY2UuIFRoZSBmb2xsb3dpbmcgaXMgb3V0cHV0IGZyb20gdGhlIHRvb2wgYGhh
cmRlbmluZy1jaGVja2A6CgpgYGAKaGFyZGVuaW5nLWNoZWNrIHZvaXBtb25pdG9yOgogUG9zaXRp
b24gSW5kZXBlbmRlbnQgRXhlY3V0YWJsZTogbm8sIG5vcm1hbCBleGVjdXRhYmxlIQogU3RhY2sg
cHJvdGVjdGVkOiBubywgbm90IGZvdW5kIQogRm9ydGlmeSBTb3VyY2UgZnVuY3Rpb25zOiB1bmtu
b3duLCBubyBwcm90ZWN0YWJsZSBsaWJjIGZ1bmN0aW9ucyB1c2VkCiBSZWFkLW9ubHkgcmVsb2Nh
dGlvbnM6IG5vLCBub3QgZm91bmQhCiBJbW1lZGlhdGUgYmluZGluZzogbm8sIG5vdCBmb3VuZCEK
IFN0YWNrIGNsYXNoIHByb3RlY3Rpb246IHVua25vd24sIG5vIC1mc3RhY2stY2xhc2gtcHJvdGVj
dGlvbiBpbnN0cnVjdGlvbnMgZm91bmQKIENvbnRyb2wgZmxvdyBpbnRlZ3JpdHk6IHVua25vd24s
IG5vIC1mY2YtcHJvdGVjdGlvbiBpbnN0cnVjdGlvbnMgZm91bmQhCmBgYAoKV2hlbiBzdGFjayBw
cm90ZWN0aW9uIHRvZ2V0aGVyIHdpdGggRm9ydGlmeSBTb3VyY2UgYW5kIG90aGVyIHByb3RlY3Rp
b24gbWVjaGFuaXNtcyBhcmUgaW4gcGxhY2UsIGV4cGxvaXRhdGlvbiBvZiBtZW1vcnkgY29ycnVw
dGlvbiB2dWxuZXJhYmlsaXRpZXMgbm9ybWFsbHkgcmVzdWx0cyBpbiBhIHByb2dyYW0gY3Jhc2gg
aW5zdGVhZCBvZiBsZWFkaW5nIHRvIHJlbW90ZSBjb2RlIGV4ZWN1dGlvbi4gTW9zdCBtb2Rlcm4g
Y29tcGlsYXRpb24gc3lzdGVtcyBjcmVhdGUgZXhlY3V0YWJsZSBiaW5hcmllcyB3aXRoIHRoZXNl
IGZlYXR1cmVzIGJ1aWx0LWluIGJ5IGRlZmF1bHQuIFdoZW4gdGhlc2UgZmVhdHVyZXMgYXJlIG5v
dCB1c2VkLCBhdHRhY2tlcnMgbWF5IGVhc2lseSBleHBsb2l0IG1lbW9yeSBjb3JydXB0aW9uIHZ1
bG5lcmFiaWxpdGllcywgc3VjaCBhcyBidWZmZXIgb3ZlcmZsb3dzLCB0byBydW4gYXJiaXRyYXJ5
IGNvZGUuIEluIHRoaXMgYWR2aXNvcnkgd2Ugd2lsbCBkZW1vbnN0cmF0ZSBob3cgYSBidWZmZXIg
b3ZlcmZsb3cgcmVwb3J0ZWQgaW4gYSBzZXBhcmF0ZSBhZHZpc29yeSwgY291bGQgYmUgYWJ1c2Vk
IHRvIHJ1biBhcmJpdHJhcnkgY29kZSBiZWNhdXNlIG9mIHRoZSBsYWNrIG9mIHN0YW5kYXJkIG1l
bW9yeSBjb3JydXB0aW9uIHByb3RlY3Rpb24gaW4gdGhlIHN0YXRpYyBidWlsZCByZWxlYXNlcyBv
ZiBWb0lQbW9uaXRvci4KClRoZSB2ZW5kb3IgaGFzIGV4cGxhaW5lZCB0aGF0OgoKPiB3ZSBhcmUg
bm90IGdvaW5nIHRvIGVuYWJsZSB0aGUgcHJvdGVjdGlvbiBpbiB0aGUgc3RhdGljIGJ1aWxkcyBh
cyB0aGUgc3BlZWQgaXMgY3JpdGljYWwgb24gbWFueSBpbnN0YWxsYXRpb25zCgo+IE91ciBzdGF0
aWMgYnVpbGQgYWxzbyB1c2VzIHRjbWFsbG9jIChyZWNvbW1lbmRlZCB2ZXJzaW9uKSB3aGljaCBp
cyByZXF1aXJlZCBmb3IgaGlnaCBwYWNrZXQvc2Vjb25kIHByb2Nlc3NpbmcgYXMgdGhlIGxpYmMg
YWxsb2NhdG9yIGlzIG5vdCBmYXN0IGVub3VnaCBlc3BlY2lhbGx5IG9uIE5VTUEgc3lzdGVtcy4g
Rm9yIGhpZ2ggcGFja2V0L3NlY29uZCB0cmFmZmljIEZPUlRJRllfU09VUkNFIGNhbiBpbnRyb2R1
Y2UgYSBsb3Qgb2YgYWRkaXRpb25hbCBDUFUgY3ljbGVzLiBJZiB1c2luZyBjdXN0b20gYnVpbGRz
IHdpdGggRk9SVElGWV9TT1VSQ0UgLSB0aGV5IHNob3VsZCBjb21wYXJlIGlmIHRoZSBzbmlmZmVy
IGRpZCBub3QgaW50cm9kdWNlZCBoaWdoZXIgQ1BVIHVzYWdlLgoKV2hpbGUgd2UgdW5kZXJzdGFu
ZCB0aGUgdmVuZG9yJ3MgcG9zaXRpb24sIHdlIGFyZSBpc3N1aW5nIGFuIGFkdmlzb3J5IHRvIGVu
c3VyZSB0aGF0IGVuZCB1c2VycyBjYW4gbWFrZSBpbmZvcm1lZCByaXNrLWJhc2VkIGRlY2lzaW9u
cy4KCiMjIEltcGFjdAoKVGhlIGxhY2sgb2Ygc3RhbmRhcmQgbWVtb3J5IGNvcnJ1cHRpb24gcHJv
dGVjdGlvbiBtZWNoYW5pc21zIG1lYW5zIHRoYXQgc3VjaCB2dWxuZXJhYmlsaXRpZXMgbWF5IGxl
YWQgdG8gcmVtb3RlIGNvZGUgZXhlY3V0aW9uLgoKIyMgSG93IHRvIHJlcHJvZHVjZSB0aGUgaXNz
dWUKCjEuIEV4ZWN1dGUgdGhlIHN0YXRpYyBidWlsZCBvZiBWb0lQbW9uaXRvciAoc3VjaCBhcyBo
dHRwczovL3d3dy52b2lwbW9uaXRvci5vcmcvY3VycmVudC1zdGFibGUtc25pZmZlci1zdGF0aWMt
NjRiaXQudGFyLmd6KQoyLiBTdGFydCB0aGUgbGl2ZSBzbmlmZmVyIGZyb20gdGhlIFZPSVBNb25p
dG9yIEdVSSBvciB2aWEgdGhlIG1hbmFnZXIgb24gcG9ydCA1MDI5CjMuIEV4ZWN1dGUgdGhlIGZv
bGxvd2luZyBQeXRob24gcHJvZ3JhbSBzbyB0aGF0IFZPSVBNb25pdG9yIGlzIGFibGUgdG8gY2Fw
dHVyZSB0aGUgcGFja2V0CjQuIE9ic2VydmUgdGhlIHBheWxvYWQgYmVpbmcgZXhlY3V0ZWQgYnkg
dGhlIGB2b2lwbW9uaXRvcmAgcHJvY2VzcywgaS5lLiB0aGUgZm9sbG93aW5nOgogICAgLSBjdXJy
ZW50IHVzZXIgaXMgcHJpbnRlZCBkdWUgdG8gZXhlY3V0aW9uIG9mIHRoZSBgd2hvYW1pYCBjb21t
YW5kCiAgICAtIGBoNHgwciB3YXMgaGVyZWAgaXMgYWxzbyBwcmludGVkCiAgICAtIGEgZmlsZSBo
YXMgYmVlbiBjcmVhdGVkIGluIGAvdG1wL3dvb3RgCgpgYGBweXRob24KaW1wb3J0IHN0cnVjdApp
bXBvcnQgc29ja2V0CgpzID0gc29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCwgc29ja2V0LlNP
Q0tfREdSQU0pCgpwYXlsb2FkX3NpemU9MzI2MDcKIyBQYWQgd2l0aCBBcwpwYXlsb2FkID0gYidB
JyAqIDcwMwpwYXlsb2FkX3NpemUtPWxlbihwYXlsb2FkKQoKIyBXcml0ZSBzeXN0ZW0gcGF5bG9h
ZApjbWQ9Yid3aG9hbWk7ZWNobyAiaDR4MHIgd2FzIGhlcmUiO3RvdWNoIC90bXAvd29vdFx4MDAn
CnBheWxvYWQrPWNtZApwYXlsb2FkX3NpemUtPWxlbihjbWQpCgojIFBhZCBzb21lIG1vcmUgc28g
dGhhdCB3ZSBjYW4gb3ZlcndyaXRlIHRoZSBzYXZlX3BhY2tldF9zcWwncyBmdW5jdGlvbiByZXR1
cm4gYWRkcmVzcwpwYXlsb2FkICs9IGInQScgKiBwYXlsb2FkX3NpemUKCiMgQ2FsbCBhIFJPUCBn
YWRnZWQgdGhhdCBpbmNyZW1lbnRzIHRoZSB2YWx1ZSBvZiB0aGUgUkRJIHJlZ2lzdGVyLCAKIyB3
aGljaCB3aWxsIG5vdyBwb2ludCB0byB0aGUgdmFsdWUgc2V0IGJ5IGNtZApwYXlsb2FkICs9IHN0
cnVjdC5wYWNrKCc8UScsIDB4MDAwMDAwMDAwMGIyMjJmMSkKCiMgUmV0dXJuIHRvIHN5c3RlbSgp
IHRvIGV4ZWN1dGUgdGhlIHZhbHVlIGluIFJESQpwYXlsb2FkICs9IHN0cnVjdC5wYWNrKCc8UScs
IDB4YjIyZmQwKQoKIyBSZXR1cm4gdG8gZXhpdCgpIHRvIGV4aXQgZ3JhY2VmdWxseQpwYXlsb2Fk
ICs9IHN0cnVjdC5wYWNrKCc8UScsIDB4ZjYwYTIwKQoKbXNnPWInUkVHSVNURVIgJXMgU0lQLzIu
MFxyXG4nICUgKHBheWxvYWQpCm1zZys9YidWaWE6IFNJUC8yLjAvVURQIDE5Mi4xNjguMS4xMzI6
MzUzOTM7cnBvcnQ7YnJhbmNoPXo5aEc0Yksta3d0VGtyZE5BTzJXdncwdlxyXG4nCm1zZys9YidN
YXgtRm9yd2FyZHM6IDcwXHJcbicKbXNnKz1iJ0Zyb206IDxzaXA6ODU4NjE3MTBAZGVtby5zaXB2
aWNpb3VzLnBybz47dGFnPW1ucTFuS0dOWkhOVWtOT0dcclxuJwptc2crPWInVG86IDxzaXA6ODU4
NjE3MTBAZGVtby5zaXB2aWNpb3VzLnBybz5cclxuJwptc2crPWInQ2FsbC1JRDogOTNYOWROWk8y
cWRjZnBkdVxyXG4nCm1zZys9YidDU2VxOiAxIFJFR0lTVEVSXHJcbicKbXNnKz1iJ0NvbnRhY3Q6
IDxzaXA6ODU4NjE3MTBAMTkyLjE2OC4xLjEzMjozNTM5Mzt0cmFuc3BvcnQ9dWRwPlxyXG4nCm1z
Zys9YidFeHBpcmVzOiA2MFxyXG4nCm1zZys9YidDb250ZW50LUxlbmd0aDogMFxyXG4nCm1zZys9
YidcclxuJwpzLnNlbmR0byhtc2csICgnMTY3LjcxLjU4Ljg0JywgNTA2MCkpCgpgYGAKCiMjIFNv
bHV0aW9uIGFuZCByZWNvbW1lbmRhdGlvbnMKClVzZXJzIHdobyB3b3VsZCBsaWtlIHRvIGhhdmUg
c3RhbmRhcmQgbWVtb3J5IGNvcnJ1cHRpb24gcHJvdGVjdGlvbiBmb3IgVm9JUG1vbml0b3Igc2hv
dWxkIGNvbXBpbGUgdGhlIGJpbmFyaWVzIHRoZW1zZWx2ZXMgYW5kIGFwcGx5IHRoZWlyIG93biB1
cGdyYWRlcyByYXRoZXIgdGhhbiB1c2luZyB0aGUgdXBncmFkZSBmZWF0dXJlIGZyb20gdGhlIFZv
SVBtb25pdG9yIEdVSSAvIHNlbnNvcnMgcGFnZS4KCldlIHJlY29tbWVuZGVkIHRoZSBmb2xsb3dp
bmcgdG8gdGhlIHZlbmRvcjoKCj4gT3VyIHJlY29tbWVuZGF0aW9uIGlzIHRoYXQgc3RhbmRhcmQg
bWVtb3J5IGNvcnJ1cHRpb24gcHJvdGVjdGlvbiBiZSBzd2l0Y2hlZCBvbiBieSBkZWZhdWx0IGlu
IHRoZSBvZmZpY2lhbCBiaW5hcnkgYnVpbGQgb2YgVm9JUG1vbml0b3IuIElmIHRoZXJlIGFyZSBz
cGVjaWZpYyByZXF1aXJlbWVudHMgZm9yIHNwZWNpZmljIHN5c3RlbXMgdGhhdCByZXF1aXJlIHN1
Y2ggZmVhdHVyZXMgdG8gYmUgc3dpdGNoZWQgb2ZmLCB0aGVuIGFkZGl0aW9uYWwgYmluYXJpZXMg
c2hvdWxkIGJlIG9mZmVyZWQsIHdpdGggYWRlcXVhdGUgZG9jdW1lbnRhdGlvbiBvZiB0aGUgcmlz
a3MgaW52b2x2ZWQuCgo+IERvIG5vdGUgdGhhdCBtZW1vcnkgY29ycnVwdGlvbiB2dWxuZXJhYmls
aXRpZXMgc2hvdWxkIGFsc28gYmUgYWRkcmVzc2VkIGFuZCBmaXhlZCBldmVuIGlmIHNlY3VyaXR5
IGZlYXR1cmVzLCBzdWNoIGFzIEZvcnRpZnksIGFyZSB1c2VkLgoKIyMgQWNrbm93bGVkZ2VtZW50
cwoKRW5hYmxlIFNlY3VyaXR5IHdvdWxkIGxpa2UgdG8gdGhhbmsgTWFydGluIFZpdCBhbmQgdGhl
IGRldmVsb3BlcnMgYXQgVm9JUG1vbml0b3IgZm9yIHRoZSB2ZXJ5IHF1aWNrIHJlc3BvbnNlcyBh
bmQgZXhwbGFuYXRpb25zIHdpdGggcmVnYXJkcyB0byB0aGlzIHNlY3VyaXR5IGlzc3VlLgoKIyMg
QWJvdXQgRW5hYmxlIFNlY3VyaXR5CgpbRW5hYmxlIFNlY3VyaXR5XShodHRwczovL3d3dy5lbmFi
bGVzZWN1cml0eS5jb20pIGRldmVsb3BzIG9mZmVuc2l2ZSBzZWN1cml0eSB0b29scyBhbmQgcHJv
dmlkZXMgcXVhbGl0eSBwZW5ldHJhdGlvbiB0ZXN0aW5nIHRvIGhlbHAgcHJvdGVjdCB5b3VyIHJl
YWwtdGltZSBjb21tdW5pY2F0aW9ucyBzeXN0ZW1zIGFnYWluc3QgYXR0YWNrLgoKIyMgRGlzY2xh
aW1lcgoKVGhlIGluZm9ybWF0aW9uIGluIHRoZSBhZHZpc29yeSBpcyBiZWxpZXZlZCB0byBiZSBh
Y2N1cmF0ZSBhdCB0aGUgdGltZSBvZiBwdWJsaXNoaW5nIGJhc2VkIG9uIGN1cnJlbnRseSBhdmFp
bGFibGUgaW5mb3JtYXRpb24uIFVzZSBvZiB0aGUgaW5mb3JtYXRpb24gY29uc3RpdHV0ZXMgYWNj
ZXB0YW5jZSBmb3IgdXNlIGluIGFuIEFTIElTIGNvbmRpdGlvbi4gVGhlcmUgYXJlIG5vIHdhcnJh
bnRpZXMgd2l0aCByZWdhcmQgdG8gdGhpcyBpbmZvcm1hdGlvbi4gTmVpdGhlciB0aGUgYXV0aG9y
IG5vciB0aGUgcHVibGlzaGVyIGFjY2VwdHMgYW55IGxpYWJpbGl0eSBmb3IgYW55IGRpcmVjdCwg
aW5kaXJlY3QsIG9yIGNvbnNlcXVlbnRpYWwgbG9zcyBvciBkYW1hZ2UgYXJpc2luZyBmcm9tIHVz
ZSBvZiwgb3IgcmVsaWFuY2Ugb24sIHRoaXMgaW5mb3JtYXRpb24uCgojIyBEaXNjbG9zdXJlIHBv
bGljeQoKVGhpcyByZXBvcnQgaXMgc3ViamVjdCB0byBFbmFibGUgU2VjdXJpdHkncyB2dWxuZXJh
YmlsaXR5IGRpc2Nsb3N1cmUgcG9saWN5IHdoaWNoIGNhbiBiZSBmb3VuZCBhdCA8aHR0cHM6Ly9n
aXRodWIuY29tL0VuYWJsZVNlY3VyaXR5L1Z1bG5lcmFiaWxpdHktRGlzY2xvc3VyZS1Qb2xpY3k+
LgoKCi0tCiAKICAgIFNhbmRybyBHYXVjaSwgQ0VPIGF0IEVuYWJsZSBTZWN1cml0eSBHbWJICgog
ICAgUmVnaXN0ZXIgb2YgQ29tcGFuaWVzOiAgICAgICBBRyBDaGFybG90dGVuYnVyZyBIUkIgMTcz
MDE2IEIKICAgIENvbXBhbnkgSFE6ICAgICAgICAgICAgICAgICAgICAgICBOZXVidXJnZXIgU3Ry
YcOfZSAxMDEgYiwgOTQwMzYgUGFzc2F1LCBHZXJtYW55CiAgICBQR1AvRW5jcnlwdGVkIGNvbW1z
OiAgICAgICBodHRwczovL2tleWJhc2UuaW8vc2FuZHJvZ2F1Y2kKICAgIE91ciBibG9nOiAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgaHR0cHM6Ly93d3cucnRjc2VjLmNvbQogICAgT3Ro
ZXIgcG9pbnRzIG9mIGNvbnRhY3Q6ICAgICAgIGh0dHBzOi8vZW5hYmxlc2VjdXJpdHkuY29tLyNj
b250YWN0LXVzCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f
XwpWb2lwc2VjIG1haWxpbmcgbGlzdApWb2lwc2VjQHZvaXBzYS5vcmcKaHR0cDovL3ZvaXBzYS5v
cmcvbWFpbG1hbi9saXN0aW5mby92b2lwc2VjX3ZvaXBzYS5vcmcK