Description
Buffer overflow in SIPfoundry sipXtapi released before 20060324 allows remote attackers to execute arbitrary code via a long CSeq field value in an INVITE message.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 3 modules
-
SIPfoundry sipXphone 2.6.0.27 CSeq Buffer Overflow
exploit/windows/sip/sipxphone_cseq
-
AIM Triton 1.0.4 CSeq Buffer Overflow
exploit/windows/sip/aim_triton_cseq
-
SIPfoundry sipXezPhone 0.35a CSeq Field Overflow
exploit/windows/sip/sipxezphone_cseq
Exploit-DB 4
- SIPfoundry sipXezPhone 0.35a - CSeq Field Overflow (Metasploit) EDB-16351 · remote · Jun 15, 2010 · verified
- SIPfoundry sipXphone 2.6.0.27 - CSeq Buffer Overflow (Metasploit) EDB-16352 · remote · Jun 15, 2010 · verified
- AIM Triton 1.0.4 - CSeq Buffer Overflow (Metasploit) EDB-16353 · remote · Jun 15, 2010 · verified
- SIPfoundry sipXtapi - 'CSeq' Remote Buffer Overflow (PoC) EDB-2000 · dos · Jul 10, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- ADV-2006-2735 vdb-entry
- 27122 vdb-entry
- 20997 third-party-advisory
- sipxtapi-cseq-bo(27681) vdb-entry
- 20060711 ERNW Security Advisory 02/2006 - Buffer Overflow in sipXtapi (used in AOL Triton) mailing-list
- 20060710 ERNW Security Advisory 02/2006 - Buffer Overflow in sipXtapi (used in AOL Triton) mailing-list
- 18906 vdb-entry
- 20060711 Re: [Full-disclosure] ERNW Security Advisory 02/2006 - Buffer Overflow in sipXtapi (used in AOL Triton) mailing-list
- 1016455 vdb-entry
- 20060710 ERNW Security Advisory 02/2006 - Buffer Overflow in sipXtapi (used in AOL Triton) mailing-list