ASTERID SIP Denial of Service Tool
Quick Dirty Linux IPTables Fix awk 'NF<=16&&($10=="transmission"||$13=="seqno")&& /Maximum/&& /Critical/&& /\./&& /@/{gsub(/@/, " ")};{print $12}' /var/log/asterisk/messages|\ grep "\."|grep -iv "[a-z]"|sed 's/'\''//g;s/:/ /g'|\ awk '{print "iptables -A INPUT -s "$1" -i eth0 -d CHANGEME -p TCP --dport 5060 -j REJECT"|"sort"}'|\ uniq|sh -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Product: Asterisk Open Source PBX Impact: Multiple Local and Remote Denials of Service MITRE CVE-2006-5445 FRSIRT ADV-2006-4098 Version(s): All versions PRIOR TO 1.2.13 Author: Jesus Oquendo echo @infiltrated|sed 's/^/sil/g;s/$/.net/g' I. BACKGROUND Asterisk is an Open Source PBX which runs on Linux, BSD, Solaris and MacOSX that provides all of the features in a standard PBX. Asterisk does voice over IP and can interoperate with almost all telephony equipment. II. DESCRIPTION A vulnerability in the SIP channel driver (channels/chan_sip.c) in all versions of Asterisk prior to 1.2.13. Local and remote attackers are able to cause a denial of service (resource consumption) via unspecified vectors that result in the creation of "a real pvt structure" that uses more resources than necessary. III SOLUTION Versions 1.2.13 and greater are no longer vulnerable to the attack and users are urged to update to 1.2.13 or better. IV. SOURCE http://www.infiltrated.net/asteroid/asteroidv1.tar.gz V. POSSIBILITIES While the initial packet creation tool was tested on Asterisk, it was not targeted towards Asterisk but at the SIP protocol. Asterisk was used merely for Wireshark packet captures in order to re-create newer packets. The Asteroid SIP denial of service tool could also affect other products that run the SIP protocol including soft phones, other PBX's, etc. VI. MENTIONS Thanks to Kevin P. Flemming and the guys at Asterisk fixing this promptly. Dan York for getting people to pay attention. Tim Donahue for his Perl pointers, vgersh99 (aka vlad) for nawk pointers, PHV, Annihilannic, p5wizard, Anthony LaMantia, Tzafir Cohen, and the others on the Asterisk-Dev list. VII. TESTBED Tested on Solaris, FreeBSD, Linux (SuSE, CentOS, Gentoo, Debian) distributions running various versions Asterisk. VIII. CHECKSUMS $ md5 asteroidv1.tar.gz MD5 (asteroidv1.tar.gz) = b32c56ab4004d2a75eeee109d9e8d824 $ sha1 asteroidv1.tar.gz SHA1 (asteroidv1.tar.gz) = 0345fc7e423bddb8d9aa5fae431c0715db70a879 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ J. Oquendo echo @infiltrated|sed 's/^/sil/g;s/$/.net/g' http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x1383A743 "How a man plays the game shows something of his character - how he loses shows all" - Mr. Luckey -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (FreeBSD) iD8DBQFFSjjZh3J3NhODp0MRAjheAKDvN9nCk8RYXiL0LlwCqvTx1MBxiwCg8Pcl D+fR6dikWMyCzW+UZTCat48= =2ekf -----END PGP SIGNATURE----- Related documents and tools: |