Bug#454141: opal: CVE-2007-4924 remote denial of service

[Nico Golde]

Package: opal
Version: 2.2.3.dfsg-1
Severity: grave
Tags: security patch

Hi, as you wanted a bug report, here it comes:
the following CVE (Common Vulnerabilities & Exposures) id was
published for opal.

CVE-2007-4924[0]:
| The Open Phone Abstraction Library (opal), as used by (1) Ekiga before
| 2.0.10 and (2) OpenH323 before 2.2.4, allows remote attackers to cause
| a denial of service (crash) via an invalid Content-Length header field
| in Session Initiation Protocol (SIP) packets, which causes a 0 byte
| to be written to an "attacker-controlled address."

If you fix this vulnerability please also include the CVE id
in your changelog entry.

http://people.debian.org/~nion/CVE-2007-4924.dpatch
should fix this, I also attached it.

For further information:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4924

Kind regards
Nico

-- 
Nico Golde - http://www.ngolde.de - nion at jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
-------------- next part --------------
#! /bin/sh /usr/share/dpatch/dpatch-run
## CVE-2007-4924.dpatch by Nico Golde <nion at debian.org>
##
## All lines beginning with `## DP:' are a description of the patch.
## DP: No description.

@DPATCH@
diff -urNad opal-2.2.3.dfsg~/src/sip/sippdu.cxx opal-2.2.3.dfsg/src/sip/sippdu.cxx
--- opal-2.2.3.dfsg~/src/sip/sippdu.cxx	2006-08-07 22:07:46.000000000 +0200
+++ opal-2.2.3.dfsg/src/sip/sippdu.cxx	2007-12-02 23:12:31.000000000 +0100
@@ -656,7 +656,7 @@
   else
     addr += hostname;
 
-  if (port != 0)
+  if (port > 0)
     addr.sprintf(":%u", port);
 
   return addr;
@@ -1815,8 +1815,18 @@
   // if no content length is specified (which is not the same as zero length)
   // then read until plausible end of header marker
   PINDEX contentLength = mime.GetContentLength();
-  if (contentLength > 0)
+ // assume entity bodies can't be longer than a UDP packet
+ if (contentLength > 1500) {
+   PTRACE(2, "SIP\tImplausibly long Content-Length " << contentLength << " received on " << transport);
+   return FALSE;
+ }
+ else if (contentLength < 0) {
+   PTRACE(2, "SIP\tImpossible negative Content-Length on " << transport);
+   return FALSE;
+ } 
+  if (contentLength > 0){
     transport.read(entityBody.GetPointer(contentLength+1), contentLength);
+  }
 
   else if (!mime.IsContentLengthPresent()) {
     PBYTEArray pp;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.alioth.debian.org/pipermail/pkg-voip-maintainers/attachments/20071203/4f00e1c7/attachment.pgp