ES2021-04: VoIPmonitor static builds are c ompiled without any standard memory corruption protection
"Sandro Gauci" <[email protected]> Mon, 15 Mar 2021 13:50:26 +0100
| Newsgroups | gmane.comp.voip.security.voipsa,gmane.comp.security.oss.general,gmane.comp.security.bugtraq,gmane.comp.security.fulldisclosure |
|---|---|
| Message-ID | <[email protected]> |
IyBWb0lQbW9uaXRvciBzdGF0aWMgYnVpbGRzIGFyZSBjb21waWxlZCB3aXRob3V0IGFueSBzdGFu ZGFyZCBtZW1vcnkgY29ycnVwdGlvbiBwcm90ZWN0aW9uCgotIEZpeGVkIHZlcnNpb25zOiBOL0EK LSBFbmFibGUgU2VjdXJpdHkgQWR2aXNvcnk6IGh0dHBzOi8vZ2l0aHViLmNvbS9FbmFibGVTZWN1 cml0eS9hZHZpc29yaWVzL3RyZWUvbWFzdGVyL0VTMjAyMS0wNC12b2lwbW9uaXRvci1zdGF0aWNi dWlsZC1tZW1vcnktY29ycnVwdGlvbi1wcm90ZWN0aW9uCi0gVm9JUG1vbml0b3IgU2VjdXJpdHkg QWR2aXNvcnk6IG5vbmUKLSBUZXN0ZWQgdnVsbmVyYWJsZSB2ZXJzaW9uczogMjcuNQotIFRpbWVs aW5lOgogICAgLSBSZXBvcnQgZGF0ZTogMjAyMS0wMi0xMCAmIDIwMjEtMDItMTMKCS0gRW5hYmxl IFNlY3VyaXR5IGFkdmlzb3J5OiAyMDIxLTAzLTE1CgojIyBEZXNjcmlwdGlvbgoKVGhlIGJpbmFy aWVzIGF2YWlsYWJsZSBmb3IgZG93bmxvYWQgYXQgPGh0dHBzOi8vd3d3LnZvaXBtb25pdG9yLm9y Zy9kb3dubG9hZD4gYXJlIGJ1aWx0IHdpdGhvdXQgYW55IG1lbW9yeSBjb3JydXB0aW9uIHByb3Rl Y3Rpb24gaW4gcGxhY2UuIFRoZSBmb2xsb3dpbmcgaXMgb3V0cHV0IGZyb20gdGhlIHRvb2wgYGhh cmRlbmluZy1jaGVja2A6CgpgYGAKaGFyZGVuaW5nLWNoZWNrIHZvaXBtb25pdG9yOgogUG9zaXRp b24gSW5kZXBlbmRlbnQgRXhlY3V0YWJsZTogbm8sIG5vcm1hbCBleGVjdXRhYmxlIQogU3RhY2sg cHJvdGVjdGVkOiBubywgbm90IGZvdW5kIQogRm9ydGlmeSBTb3VyY2UgZnVuY3Rpb25zOiB1bmtu b3duLCBubyBwcm90ZWN0YWJsZSBsaWJjIGZ1bmN0aW9ucyB1c2VkCiBSZWFkLW9ubHkgcmVsb2Nh dGlvbnM6IG5vLCBub3QgZm91bmQhCiBJbW1lZGlhdGUgYmluZGluZzogbm8sIG5vdCBmb3VuZCEK IFN0YWNrIGNsYXNoIHByb3RlY3Rpb246IHVua25vd24sIG5vIC1mc3RhY2stY2xhc2gtcHJvdGVj dGlvbiBpbnN0cnVjdGlvbnMgZm91bmQKIENvbnRyb2wgZmxvdyBpbnRlZ3JpdHk6IHVua25vd24s IG5vIC1mY2YtcHJvdGVjdGlvbiBpbnN0cnVjdGlvbnMgZm91bmQhCmBgYAoKV2hlbiBzdGFjayBw cm90ZWN0aW9uIHRvZ2V0aGVyIHdpdGggRm9ydGlmeSBTb3VyY2UgYW5kIG90aGVyIHByb3RlY3Rp b24gbWVjaGFuaXNtcyBhcmUgaW4gcGxhY2UsIGV4cGxvaXRhdGlvbiBvZiBtZW1vcnkgY29ycnVw dGlvbiB2dWxuZXJhYmlsaXRpZXMgbm9ybWFsbHkgcmVzdWx0cyBpbiBhIHByb2dyYW0gY3Jhc2gg aW5zdGVhZCBvZiBsZWFkaW5nIHRvIHJlbW90ZSBjb2RlIGV4ZWN1dGlvbi4gTW9zdCBtb2Rlcm4g Y29tcGlsYXRpb24gc3lzdGVtcyBjcmVhdGUgZXhlY3V0YWJsZSBiaW5hcmllcyB3aXRoIHRoZXNl IGZlYXR1cmVzIGJ1aWx0LWluIGJ5IGRlZmF1bHQuIFdoZW4gdGhlc2UgZmVhdHVyZXMgYXJlIG5v dCB1c2VkLCBhdHRhY2tlcnMgbWF5IGVhc2lseSBleHBsb2l0IG1lbW9yeSBjb3JydXB0aW9uIHZ1 bG5lcmFiaWxpdGllcywgc3VjaCBhcyBidWZmZXIgb3ZlcmZsb3dzLCB0byBydW4gYXJiaXRyYXJ5 IGNvZGUuIEluIHRoaXMgYWR2aXNvcnkgd2Ugd2lsbCBkZW1vbnN0cmF0ZSBob3cgYSBidWZmZXIg b3ZlcmZsb3cgcmVwb3J0ZWQgaW4gYSBzZXBhcmF0ZSBhZHZpc29yeSwgY291bGQgYmUgYWJ1c2Vk IHRvIHJ1biBhcmJpdHJhcnkgY29kZSBiZWNhdXNlIG9mIHRoZSBsYWNrIG9mIHN0YW5kYXJkIG1l bW9yeSBjb3JydXB0aW9uIHByb3RlY3Rpb24gaW4gdGhlIHN0YXRpYyBidWlsZCByZWxlYXNlcyBv ZiBWb0lQbW9uaXRvci4KClRoZSB2ZW5kb3IgaGFzIGV4cGxhaW5lZCB0aGF0OgoKPiB3ZSBhcmUg bm90IGdvaW5nIHRvIGVuYWJsZSB0aGUgcHJvdGVjdGlvbiBpbiB0aGUgc3RhdGljIGJ1aWxkcyBh cyB0aGUgc3BlZWQgaXMgY3JpdGljYWwgb24gbWFueSBpbnN0YWxsYXRpb25zCgo+IE91ciBzdGF0 aWMgYnVpbGQgYWxzbyB1c2VzIHRjbWFsbG9jIChyZWNvbW1lbmRlZCB2ZXJzaW9uKSB3aGljaCBp cyByZXF1aXJlZCBmb3IgaGlnaCBwYWNrZXQvc2Vjb25kIHByb2Nlc3NpbmcgYXMgdGhlIGxpYmMg YWxsb2NhdG9yIGlzIG5vdCBmYXN0IGVub3VnaCBlc3BlY2lhbGx5IG9uIE5VTUEgc3lzdGVtcy4g Rm9yIGhpZ2ggcGFja2V0L3NlY29uZCB0cmFmZmljIEZPUlRJRllfU09VUkNFIGNhbiBpbnRyb2R1 Y2UgYSBsb3Qgb2YgYWRkaXRpb25hbCBDUFUgY3ljbGVzLiBJZiB1c2luZyBjdXN0b20gYnVpbGRz IHdpdGggRk9SVElGWV9TT1VSQ0UgLSB0aGV5IHNob3VsZCBjb21wYXJlIGlmIHRoZSBzbmlmZmVy IGRpZCBub3QgaW50cm9kdWNlZCBoaWdoZXIgQ1BVIHVzYWdlLgoKV2hpbGUgd2UgdW5kZXJzdGFu ZCB0aGUgdmVuZG9yJ3MgcG9zaXRpb24sIHdlIGFyZSBpc3N1aW5nIGFuIGFkdmlzb3J5IHRvIGVu c3VyZSB0aGF0IGVuZCB1c2VycyBjYW4gbWFrZSBpbmZvcm1lZCByaXNrLWJhc2VkIGRlY2lzaW9u cy4KCiMjIEltcGFjdAoKVGhlIGxhY2sgb2Ygc3RhbmRhcmQgbWVtb3J5IGNvcnJ1cHRpb24gcHJv dGVjdGlvbiBtZWNoYW5pc21zIG1lYW5zIHRoYXQgc3VjaCB2dWxuZXJhYmlsaXRpZXMgbWF5IGxl YWQgdG8gcmVtb3RlIGNvZGUgZXhlY3V0aW9uLgoKIyMgSG93IHRvIHJlcHJvZHVjZSB0aGUgaXNz dWUKCjEuIEV4ZWN1dGUgdGhlIHN0YXRpYyBidWlsZCBvZiBWb0lQbW9uaXRvciAoc3VjaCBhcyBo dHRwczovL3d3dy52b2lwbW9uaXRvci5vcmcvY3VycmVudC1zdGFibGUtc25pZmZlci1zdGF0aWMt NjRiaXQudGFyLmd6KQoyLiBTdGFydCB0aGUgbGl2ZSBzbmlmZmVyIGZyb20gdGhlIFZPSVBNb25p dG9yIEdVSSBvciB2aWEgdGhlIG1hbmFnZXIgb24gcG9ydCA1MDI5CjMuIEV4ZWN1dGUgdGhlIGZv bGxvd2luZyBQeXRob24gcHJvZ3JhbSBzbyB0aGF0IFZPSVBNb25pdG9yIGlzIGFibGUgdG8gY2Fw dHVyZSB0aGUgcGFja2V0CjQuIE9ic2VydmUgdGhlIHBheWxvYWQgYmVpbmcgZXhlY3V0ZWQgYnkg dGhlIGB2b2lwbW9uaXRvcmAgcHJvY2VzcywgaS5lLiB0aGUgZm9sbG93aW5nOgogICAgLSBjdXJy ZW50IHVzZXIgaXMgcHJpbnRlZCBkdWUgdG8gZXhlY3V0aW9uIG9mIHRoZSBgd2hvYW1pYCBjb21t YW5kCiAgICAtIGBoNHgwciB3YXMgaGVyZWAgaXMgYWxzbyBwcmludGVkCiAgICAtIGEgZmlsZSBo YXMgYmVlbiBjcmVhdGVkIGluIGAvdG1wL3dvb3RgCgpgYGBweXRob24KaW1wb3J0IHN0cnVjdApp bXBvcnQgc29ja2V0CgpzID0gc29ja2V0LnNvY2tldChzb2NrZXQuQUZfSU5FVCwgc29ja2V0LlNP Q0tfREdSQU0pCgpwYXlsb2FkX3NpemU9MzI2MDcKIyBQYWQgd2l0aCBBcwpwYXlsb2FkID0gYidB JyAqIDcwMwpwYXlsb2FkX3NpemUtPWxlbihwYXlsb2FkKQoKIyBXcml0ZSBzeXN0ZW0gcGF5bG9h ZApjbWQ9Yid3aG9hbWk7ZWNobyAiaDR4MHIgd2FzIGhlcmUiO3RvdWNoIC90bXAvd29vdFx4MDAn CnBheWxvYWQrPWNtZApwYXlsb2FkX3NpemUtPWxlbihjbWQpCgojIFBhZCBzb21lIG1vcmUgc28g dGhhdCB3ZSBjYW4gb3ZlcndyaXRlIHRoZSBzYXZlX3BhY2tldF9zcWwncyBmdW5jdGlvbiByZXR1 cm4gYWRkcmVzcwpwYXlsb2FkICs9IGInQScgKiBwYXlsb2FkX3NpemUKCiMgQ2FsbCBhIFJPUCBn YWRnZWQgdGhhdCBpbmNyZW1lbnRzIHRoZSB2YWx1ZSBvZiB0aGUgUkRJIHJlZ2lzdGVyLCAKIyB3 aGljaCB3aWxsIG5vdyBwb2ludCB0byB0aGUgdmFsdWUgc2V0IGJ5IGNtZApwYXlsb2FkICs9IHN0 cnVjdC5wYWNrKCc8UScsIDB4MDAwMDAwMDAwMGIyMjJmMSkKCiMgUmV0dXJuIHRvIHN5c3RlbSgp IHRvIGV4ZWN1dGUgdGhlIHZhbHVlIGluIFJESQpwYXlsb2FkICs9IHN0cnVjdC5wYWNrKCc8UScs IDB4YjIyZmQwKQoKIyBSZXR1cm4gdG8gZXhpdCgpIHRvIGV4aXQgZ3JhY2VmdWxseQpwYXlsb2Fk ICs9IHN0cnVjdC5wYWNrKCc8UScsIDB4ZjYwYTIwKQoKbXNnPWInUkVHSVNURVIgJXMgU0lQLzIu MFxyXG4nICUgKHBheWxvYWQpCm1zZys9YidWaWE6IFNJUC8yLjAvVURQIDE5Mi4xNjguMS4xMzI6 MzUzOTM7cnBvcnQ7YnJhbmNoPXo5aEc0Yksta3d0VGtyZE5BTzJXdncwdlxyXG4nCm1zZys9YidN YXgtRm9yd2FyZHM6IDcwXHJcbicKbXNnKz1iJ0Zyb206IDxzaXA6ODU4NjE3MTBAZGVtby5zaXB2 aWNpb3VzLnBybz47dGFnPW1ucTFuS0dOWkhOVWtOT0dcclxuJwptc2crPWInVG86IDxzaXA6ODU4 NjE3MTBAZGVtby5zaXB2aWNpb3VzLnBybz5cclxuJwptc2crPWInQ2FsbC1JRDogOTNYOWROWk8y cWRjZnBkdVxyXG4nCm1zZys9YidDU2VxOiAxIFJFR0lTVEVSXHJcbicKbXNnKz1iJ0NvbnRhY3Q6 IDxzaXA6ODU4NjE3MTBAMTkyLjE2OC4xLjEzMjozNTM5Mzt0cmFuc3BvcnQ9dWRwPlxyXG4nCm1z Zys9YidFeHBpcmVzOiA2MFxyXG4nCm1zZys9YidDb250ZW50LUxlbmd0aDogMFxyXG4nCm1zZys9 YidcclxuJwpzLnNlbmR0byhtc2csICgnMTY3LjcxLjU4Ljg0JywgNTA2MCkpCgpgYGAKCiMjIFNv bHV0aW9uIGFuZCByZWNvbW1lbmRhdGlvbnMKClVzZXJzIHdobyB3b3VsZCBsaWtlIHRvIGhhdmUg c3RhbmRhcmQgbWVtb3J5IGNvcnJ1cHRpb24gcHJvdGVjdGlvbiBmb3IgVm9JUG1vbml0b3Igc2hv dWxkIGNvbXBpbGUgdGhlIGJpbmFyaWVzIHRoZW1zZWx2ZXMgYW5kIGFwcGx5IHRoZWlyIG93biB1 cGdyYWRlcyByYXRoZXIgdGhhbiB1c2luZyB0aGUgdXBncmFkZSBmZWF0dXJlIGZyb20gdGhlIFZv SVBtb25pdG9yIEdVSSAvIHNlbnNvcnMgcGFnZS4KCldlIHJlY29tbWVuZGVkIHRoZSBmb2xsb3dp bmcgdG8gdGhlIHZlbmRvcjoKCj4gT3VyIHJlY29tbWVuZGF0aW9uIGlzIHRoYXQgc3RhbmRhcmQg bWVtb3J5IGNvcnJ1cHRpb24gcHJvdGVjdGlvbiBiZSBzd2l0Y2hlZCBvbiBieSBkZWZhdWx0IGlu IHRoZSBvZmZpY2lhbCBiaW5hcnkgYnVpbGQgb2YgVm9JUG1vbml0b3IuIElmIHRoZXJlIGFyZSBz cGVjaWZpYyByZXF1aXJlbWVudHMgZm9yIHNwZWNpZmljIHN5c3RlbXMgdGhhdCByZXF1aXJlIHN1 Y2ggZmVhdHVyZXMgdG8gYmUgc3dpdGNoZWQgb2ZmLCB0aGVuIGFkZGl0aW9uYWwgYmluYXJpZXMg c2hvdWxkIGJlIG9mZmVyZWQsIHdpdGggYWRlcXVhdGUgZG9jdW1lbnRhdGlvbiBvZiB0aGUgcmlz a3MgaW52b2x2ZWQuCgo+IERvIG5vdGUgdGhhdCBtZW1vcnkgY29ycnVwdGlvbiB2dWxuZXJhYmls aXRpZXMgc2hvdWxkIGFsc28gYmUgYWRkcmVzc2VkIGFuZCBmaXhlZCBldmVuIGlmIHNlY3VyaXR5 IGZlYXR1cmVzLCBzdWNoIGFzIEZvcnRpZnksIGFyZSB1c2VkLgoKIyMgQWNrbm93bGVkZ2VtZW50 cwoKRW5hYmxlIFNlY3VyaXR5IHdvdWxkIGxpa2UgdG8gdGhhbmsgTWFydGluIFZpdCBhbmQgdGhl IGRldmVsb3BlcnMgYXQgVm9JUG1vbml0b3IgZm9yIHRoZSB2ZXJ5IHF1aWNrIHJlc3BvbnNlcyBh bmQgZXhwbGFuYXRpb25zIHdpdGggcmVnYXJkcyB0byB0aGlzIHNlY3VyaXR5IGlzc3VlLgoKIyMg QWJvdXQgRW5hYmxlIFNlY3VyaXR5CgpbRW5hYmxlIFNlY3VyaXR5XShodHRwczovL3d3dy5lbmFi bGVzZWN1cml0eS5jb20pIGRldmVsb3BzIG9mZmVuc2l2ZSBzZWN1cml0eSB0b29scyBhbmQgcHJv dmlkZXMgcXVhbGl0eSBwZW5ldHJhdGlvbiB0ZXN0aW5nIHRvIGhlbHAgcHJvdGVjdCB5b3VyIHJl YWwtdGltZSBjb21tdW5pY2F0aW9ucyBzeXN0ZW1zIGFnYWluc3QgYXR0YWNrLgoKIyMgRGlzY2xh aW1lcgoKVGhlIGluZm9ybWF0aW9uIGluIHRoZSBhZHZpc29yeSBpcyBiZWxpZXZlZCB0byBiZSBh Y2N1cmF0ZSBhdCB0aGUgdGltZSBvZiBwdWJsaXNoaW5nIGJhc2VkIG9uIGN1cnJlbnRseSBhdmFp bGFibGUgaW5mb3JtYXRpb24uIFVzZSBvZiB0aGUgaW5mb3JtYXRpb24gY29uc3RpdHV0ZXMgYWNj ZXB0YW5jZSBmb3IgdXNlIGluIGFuIEFTIElTIGNvbmRpdGlvbi4gVGhlcmUgYXJlIG5vIHdhcnJh bnRpZXMgd2l0aCByZWdhcmQgdG8gdGhpcyBpbmZvcm1hdGlvbi4gTmVpdGhlciB0aGUgYXV0aG9y IG5vciB0aGUgcHVibGlzaGVyIGFjY2VwdHMgYW55IGxpYWJpbGl0eSBmb3IgYW55IGRpcmVjdCwg aW5kaXJlY3QsIG9yIGNvbnNlcXVlbnRpYWwgbG9zcyBvciBkYW1hZ2UgYXJpc2luZyBmcm9tIHVz ZSBvZiwgb3IgcmVsaWFuY2Ugb24sIHRoaXMgaW5mb3JtYXRpb24uCgojIyBEaXNjbG9zdXJlIHBv bGljeQoKVGhpcyByZXBvcnQgaXMgc3ViamVjdCB0byBFbmFibGUgU2VjdXJpdHkncyB2dWxuZXJh YmlsaXR5IGRpc2Nsb3N1cmUgcG9saWN5IHdoaWNoIGNhbiBiZSBmb3VuZCBhdCA8aHR0cHM6Ly9n aXRodWIuY29tL0VuYWJsZVNlY3VyaXR5L1Z1bG5lcmFiaWxpdHktRGlzY2xvc3VyZS1Qb2xpY3k+ LgoKCi0tCiAKICAgIFNhbmRybyBHYXVjaSwgQ0VPIGF0IEVuYWJsZSBTZWN1cml0eSBHbWJICgog ICAgUmVnaXN0ZXIgb2YgQ29tcGFuaWVzOiAgICAgICBBRyBDaGFybG90dGVuYnVyZyBIUkIgMTcz MDE2IEIKICAgIENvbXBhbnkgSFE6ICAgICAgICAgICAgICAgICAgICAgICBOZXVidXJnZXIgU3Ry YcOfZSAxMDEgYiwgOTQwMzYgUGFzc2F1LCBHZXJtYW55CiAgICBQR1AvRW5jcnlwdGVkIGNvbW1z OiAgICAgICBodHRwczovL2tleWJhc2UuaW8vc2FuZHJvZ2F1Y2kKICAgIE91ciBibG9nOiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgaHR0cHM6Ly93d3cucnRjc2VjLmNvbQogICAgT3Ro ZXIgcG9pbnRzIG9mIGNvbnRhY3Q6ICAgICAgIGh0dHBzOi8vZW5hYmxlc2VjdXJpdHkuY29tLyNj b250YWN0LXVzCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f XwpWb2lwc2VjIG1haWxpbmcgbGlzdApWb2lwc2VjQHZvaXBzYS5vcmcKaHR0cDovL3ZvaXBzYS5v cmcvbWFpbG1hbi9saXN0aW5mby92b2lwc2VjX3ZvaXBzYS5vcmcK