As part of VoIP threats series, I’d like to introduce Malformed Messages (or Protocol Fuzzing). An attacker may create and send malformed messages to the target server or client for the purpose of service interruption. A malformed message is a protocol message with wrong syntax. The following shows an example with a SIP INVITE message.
INVITE aaaaaaaaaa sip:UserB@example.com SIP/2.02xTb9vxSit55XU7p8@example.com
Via: SIP/2.0/UDP userAclient.example.com:5060;branch=z9hG4bK74bf9
Max-Forwards: 70
From::::::::::::: UserA
To: UserB
Call-ID:
CSeq: 1 INVITE
Contact:
Content-Type: application/sdp
Content-Length: 151
v==============0
o=UserA 2890844526 2890844526 IN IP4 userAclient.example.com
s=-
c=IN IP4 192.0.2.101
t=0 0
m=audio 49172 RTP/AVP 0
a=rtpmap:0 PCMU/8000
You can find something wrong in the example of an INVITE message. Two SIP headers (Request-URI and From) and one version in Session Description Protocol (SDP) have the wrong format. The server receiving this kind of unexpected message could be confused (fuzzed) and react in many different ways depending on the implementation. The typical impacts are as follows:
- Infinite loop of parsing
- Buffer overflow, which may permit execution of arbitrary code
- Break state machine
- Unable to process other normal messages
- System crash
This vulnerability comes from the following sources in general:
1. Weakness of protocol specification: Most VoIP protocols are open to the public and don’t strictly define every single line. Attackers could find where the weakness of syntax is. Additionally, there are many customizable fields or tags.
2. Ease of creating the malformed message: Creating a message like that in the example is easy for regular programmers. Even for nonprogrammers, many tools are available to make customized messages.
3. Lack of exception handling in the implementation: Because of time restrictions, most implementers are apt to focus on product features and interfaces, rather than create exception handling for massive negative cases.
4. Difficulty of testing all malformed cases: It is very difficult to test all the negative cases, even though sophisticated testing tools covering more cases are coming out these days.
The threat of malformed messages should be preventable as long as the parsing algorithm handles them properly.
(Note)
Protocol fuzzing is another name for malformed messages. A small difference is that protocol fuzzing includes malicious messages that have correct syntax but break the sequence of messages, which may cause system error by making the state machine confused.
