0

In order to study vulnerabilities of a SIP server and the impacts of DOS attacks on the QoS of VoIP service, I have found this vulnerability which can be exploited to cause DoS on SIP server.

But I need clarification in a few areas:

  • How it can be possible for an attacker to cause an overflow ?
  • What is the relationship between an overflow and denial of service attacks that can occur at the OpenSER?

I did not understand the description and the action performed by the attacker.

|improve this question
  • It is most likely to be exploitable by hand-crafting a malicous SMS binary with an overlong field (read into the pdu argument) and placing that SMS in the queue to be processed by the server. The overlong data will be written into memory that may already be in use by something else. The server can be crashed (or perhaps worse) if a user sends a text message like this. – Cheekysoft Jun 22 '12 at 13:40
  • what raises the denial of service. in other words, what is the relationship between memory overflow and dos? – Mely Jun 22 '12 at 13:44
  • 1
    Memory corruption. The overlong user-data will overwrite existingly used memory, corrupting the values stored there. With an invalid state, the program cannot continue to execute as normal, resulting in undefined behaviour. – Cheekysoft Jun 22 '12 at 13:45
  • very old reference, but seminal and relevant insecure.org/stf/smashstack.html – Cheekysoft Jun 22 '12 at 13:49
  • For me if it will have a corrption of the memory, An interrupt triggers.but the return address is overwritten, is that it has a relationship with DOS – Mely Jun 22 '12 at 13:50
1

How it can be possible for an attacker to cause an overflow ?

Overflow can be done in many ways. All network applications receive parameter value data on network packets, it is an value for an variable in that application.

If a clients sends packet with a value that is invalid datatype or is too large for that application's variable then it will cause overflow. The application's variable/parameter will get the invalid or over sized value is received in a network packet, it will most likely destabilize the application.

Example - In some single threaded application will not be able to continue any further processing due to invalid input/data type and cannot respond to any other requests causing effect of DoS. Not all overflows will result into code execution. In some overflows the received executable code from network can be executed if the pointer is correct.

|improve this answer
2

The vulnerability is actually unproven, (No POC) and it's been six (6) years since it has been listed to the CVE database. I bet it has been fixed since then up to the recent version of OpenSER. The overview description will get you going:

"Buffer overflow in the fetchsms function in the SMS handling module (libsms_getsms.c) in OpenSER 1.2.0 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SMS message, triggering memory corruption when the "beginning" buffer is copied to the third (pdu) argument."

Since there is no proof of concept or even a sample snippet of an actual exploit code, I can't assume the validity of this claim.

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-6876

http://xforce.iss.net/xforce/xfdb/31137

http://www.securityfocus.com/bid/21800/exploit

For a POC, you might want to check exploit-db for that.

There are many types of buffer overflow, it can be heap-based or stack-based etc. The very concept of an overflow is that the attacker may send more data in a buffer (the temporary storage in memory) than it can hold. This is usually the account of programming error and not setting bound checking which can lead to the running application to crash.

|improve this answer
  • Do you know what is exactly the cause of the crash is it the execution of malicious code once the overflow is occuring – Mely Jun 22 '12 at 14:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.