ZoIPer < 2.24 Crafted SIP INVITE Request Remote DoS - Nessus

Medium   Plugin ID: 48273

---

This page contains detailed information about the ZoIPer < 2.24 Crafted SIP INVITE Request Remote DoS Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Plugin Overview

---

ID: 48273
Name: ZoIPer < 2.24 Crafted SIP INVITE Request Remote DoS
Filename: zoiper_2_24.nasl
Vulnerability Published: 2009-10-14
This Plugin Published: 2010-08-09
Last Modification Time: 2018-08-07
Plugin Version: 1.7
Plugin Type: local
Plugin Family: Windows
Dependencies: smb_hotfixes.nasl
Required KB Items [?]: SMB/Registry/Enumerated

Vulnerability Information

---

Severity: Medium
Vulnerability Published: 2009-10-14
Patch Published: 2009-10-14
CVE [?]: CVE-2009-3704
CPE [?]: N/A

Synopsis

The remote Windows host contains an application that is susceptible to a denial of service attack.

Description

According to its version, the instance of Zoiper, a VoIP software phone application, installed on the remote host may crash if it receives a specially crafted SIP packet.

An unauthenticated, remote attacker can leverage this issue to deny service to legitimate users.

Solution

Upgrade to version 2.24 or later as that reportedly addresses the issue.

Public Exploits

---

Target Network Port(s): 139, 445
Target Asset(s): N/A
Exploit Available: True (Exploit-DB)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the ZoIPer < 2.24 Crafted SIP INVITE Request Remote DoS vulnerability:

1. Exploit-DB: exploits/multiple/dos/9987.py
   [EDB-9987: ZoIPer 2.22 - Call-Info Remote Denial of Service]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information

---

CVSS V2 Vector [?]: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C

CVSS Base Score:	5.0 (Medium)
Impact Subscore:	2.9
Exploitability Subscore:	10.0
CVSS Temporal Score:	3.9 (Low)
CVSS Environmental Score:	NA (None)
Modified Impact Subscore:	NA
Overall CVSS Score:	3.9 (Low)

Go back to menu.

Plugin Source

---

This is the zoiper_2_24.nasl nessus plugin source code. This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.

#
# (C) Tenable Network Security, Inc.
#


include("compat.inc");


if (description)
{
  script_id(48273);
  script_version("1.7");
  script_cvs_date("Date: 2018/08/07 16:46:51");

  script_cve_id("CVE-2009-3704");
  script_bugtraq_id(42214);
  script_xref(name:"EDB-ID", value:"9987");

  script_name(english:"ZoIPer < 2.24 Crafted SIP INVITE Request Remote DoS");
  script_summary(english:"Checks file version of zoiper.exe");

  script_set_attribute(attribute:"synopsis", value:
"The remote Windows host contains an application that is susceptible to
a denial of service attack.");
  script_set_attribute(attribute:"description", value:
"According to its version, the instance of Zoiper, a VoIP software
phone application, installed on the remote host may crash if it
receives a specially crafted SIP packet.

An unauthenticated, remote attacker can leverage this issue to deny
service to legitimate users.");
  script_set_attribute(attribute:"solution", value:
"Upgrade to version 2.24 or later as that reportedly addresses the
issue.");
 script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P");
 script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
 script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
 script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2009/10/14");
  script_set_attribute(attribute:"patch_publication_date", value:"2009/10/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2010/08/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2010-2018 Tenable Network Security, Inc.");

  script_dependencies("smb_hotfixes.nasl");
  script_require_keys("SMB/Registry/Enumerated");
  script_require_ports(139, 445);

  exit(0);
}


include("global_settings.inc");
include("misc_func.inc");
include("smb_func.inc");
include("audit.inc");


if (!get_kb_item("SMB/Registry/Enumerated")) exit(1, "The registry wasn't enumerated.");


# Connect to the appropriate share.
name    =  kb_smb_name();
port    =  kb_smb_transport();
login   =  kb_smb_login();
pass    =  kb_smb_password();
domain  =  kb_smb_domain();



if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');


# Connect to remote registry.
rc = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$");
if (rc != 1)
{
  NetUseDel();
  exit(1, "Can't connect to IPC$ share.");
}

hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
if (isnull(hklm))
{
  NetUseDel();
  exit(1, "Can't connect to remote registry.");
}


# Find where it's installed.
path = NULL;

key = "SOFTWARE\Attractel\Zoiper";
key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
if (!isnull(key_h))
{
  value = RegQueryValue(handle:key_h, item:NULL);
  if (!isnull(value)) path = value[1];

  RegCloseKey(handle:key_h);
}
RegCloseKey(handle:hklm);

if (isnull(path))
{
  NetUseDel();
  exit(0, "Zoiper is not installed.");
}
NetUseDel(close:FALSE);


# Check the version of the main exe.
share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:path);
exe =  ereg_replace(pattern:"^[A-Za-z]:(.*)", replace:"\1\zoiper.exe", string:path);

rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
if (rc != 1)
{
  NetUseDel();
  exit(1, "Can't connect to "+share+" share.");
}

fh = CreateFile(
  file               : exe,
  desired_access     : GENERIC_READ,
  file_attributes    : FILE_ATTRIBUTE_NORMAL,
  share_mode         : FILE_SHARE_READ,
  create_disposition : OPEN_EXISTING
);

ver = NULL;
if (!isnull(fh))
{
  ver = GetFileVersion(handle:fh);
  CloseFile(handle:fh);
}
NetUseDel();


# Check the version number.
if (!isnull(ver))
{
  version = ver[0] + '.' + ver[2];
  fixed_version = '2.24';

  # nb: we're checking the file version, not the user-friendly version.
  if (ver_compare(ver:ver, fix:"2.0.24.0") == -1)
  {
    if (report_verbosity > 0)
    {
      report =
        '\n  Path              : ' + path +
        '\n  Installed version : ' + version +
        '\n  Fixed version     : ' + fixed_version + '\n';
      security_warning(port:port, extra:report);
    }
    else security_warning(port);
    exit(0);
  }
  exit(0, "Zoiper version "+version+" is installed and hence not affected.");
}
else exit(1, "Couldn't get file version of '"+(share-'$')+":"+exe+"'.");

The latest version of this script can be found in these locations depending on your platform:

• Linux / Unix:
  /opt/nessus/lib/nessus/plugins/zoiper_2_24.nasl
• Windows:
  C:\ProgramData\Tenable\Nessus\nessus\plugins\zoiper_2_24.nasl
• Mac OS X:
  /Library/Nessus/run/lib/nessus/plugins/zoiper_2_24.nasl

Go back to menu.

How to Run

---

Here is how to run the ZoIPer < 2.24 Crafted SIP INVITE Request Remote DoS as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

1. Click to start a New Scan.
2. Select Advanced Scan.
3. Navigate to the Plugins tab.
4. On the top right corner click to Disable All plugins.
5. On the left side table select Windows plugin family.
6. On the right side table select ZoIPer < 2.24 Crafted SIP INVITE Request Remote DoS plugin ID 48273.
7. Specify the target on the Settings tab and click to Save the scan.
8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl zoiper_2_24.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a zoiper_2_24.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - zoiper_2_24.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state zoiper_2_24.nasl -t <IP/HOST>

Go back to menu.

References

---

BID | SecurityFocus Bugtraq ID:

• 42214

See also:

• https://www.tenable.com/plugins/nessus/48273
• https://vulners.com/nessus/ZOIPER_2_24.NASL

Version

---

This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file zoiper_2_24.nasl version 1.7. For more plugins, visit the Nessus Plugin Library.

Go back to menu.