Re: [Linphone-users] ADSL modem crash when using linphone-2.0.0

[Alastair Johnson]

I think it's a problem with both. The problem in 64 bit linphone just happens 
to trigger the LiveBox problem.

The LiveBox seems to have a DoS vulnerability. If sent a large number of 
REGISTER requests which never complete then it locks up. This ought to be 
verified and reported, but I'll be surprised if they do anything about it.

Linphone when compiled for x86_64 seems to parse the REGISTER reply 
incorrectly, rejecting valid replies as invalid and resending a REGISTER 
request. It shouldn't misparse in the first place, and it should probably 
rate-limit repeat requests to a server that consistently gives malformed 
replies. I'll try to find out exactly what the problem is, but I've several 
higher priorities at the moment.

On Thursday 29 November 2007, Simon Morlat wrote:
> Hello,
>
> Obviously this is a modem problem.
> Whatever linphone does, even if it does the worst SIP things of the world,
> the LiveBox must not crash. It's a major security flaw. Imagine that
> somebody could decide to crash all livebox of the world simply sending a
> REGISTER message generated with linphone ? Too easy !
> My freebox (from the french provider free.fr ) does not crash when I use
> linphone-2.0.0 (however it has other problems related to ADSL connection,
> I'm not saying that the freebox is better than Orange's LiveBox).
> You should report this problem to Orange, I have no doubt that they'll give
> a try and fix it by updating the firmware.
>
> Regards,
>
> Simon
>
> > Will, I don't believe it's a modem problem, as I mentioned already, it's
> > logical to think that something wrong with this particular program,
> > simply because all the other programs I tested do not have any issues
> > with my modem. Secondly, I'd like to mention that the modem isn't old and
> > it has build-in VoIP capabilities (but locked to my provider, so I don't
> > use them), so the modem should be able to handle VoIP traffic.
> >
> > Vladimir.
> >
> >
> >
> > _______________________________________________
> > Linphone-users mailing list
> > address@hidden
> > http://lists.nongnu.org/mailman/listinfo/linphone-users
>
> _______________________________________________
> Linphone-users mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/linphone-users