linphone-users
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Re: [Linphone-users] ADSL modem crash when using linphone-2.0.0


From: vladimir
Subject: Re: Re: [Linphone-users] ADSL modem crash when using linphone-2.0.0
Date: Fri, 30 Nov 2007 16:24:36 +0100
User-agent: Internet Messaging Program (IMP) H3 (4.2-ALPHA)

I would agree with you. LiveBox and a lot of other ADSL modems, all are having a _kind_ of DoS vulnerability. In my observations, it's just can't keep more then a particular limit of open/half-open connections.

Quoting Alastair Johnson <address@hidden>:

I think it's a problem with both. The problem in 64 bit linphone just happens
to trigger the LiveBox problem.

The LiveBox seems to have a DoS vulnerability. If sent a large number of
REGISTER requests which never complete then it locks up. This ought to be
verified and reported, but I'll be surprised if they do anything about it.

Linphone when compiled for x86_64 seems to parse the REGISTER reply
incorrectly, rejecting valid replies as invalid and resending a REGISTER
request. It shouldn't misparse in the first place, and it should probably
rate-limit repeat requests to a server that consistently gives malformed
replies. I'll try to find out exactly what the problem is, but I've several
higher priorities at the moment.

On Thursday 29 November 2007, Simon Morlat wrote:
Hello,

Obviously this is a modem problem.
Whatever linphone does, even if it does the worst SIP things of the world,
the LiveBox must not crash. It's a major security flaw. Imagine that
somebody could decide to crash all livebox of the world simply sending a
REGISTER message generated with linphone ? Too easy !
My freebox (from the french provider free.fr ) does not crash when I use
linphone-2.0.0 (however it has other problems related to ADSL connection,
I'm not saying that the freebox is better than Orange's LiveBox).
You should report this problem to Orange, I have no doubt that they'll give
a try and fix it by updating the firmware.

Regards,

Simon

> Will, I don't believe it's a modem problem, as I mentioned already, it's
> logical to think that something wrong with this particular program,
> simply because all the other programs I tested do not have any issues
> with my modem. Secondly, I'd like to mention that the modem isn't old and
> it has build-in VoIP capabilities (but locked to my provider, so I don't
> use them), so the modem should be able to handle VoIP traffic.
>
> Vladimir.
>
>
>
> _______________________________________________
> Linphone-users mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/linphone-users

_______________________________________________
Linphone-users mailing list
address@hidden
http://lists.nongnu.org/mailman/listinfo/linphone-users




_______________________________________________
Linphone-users mailing list
address@hidden
http://lists.nongnu.org/mailman/listinfo/linphone-users









reply via email to

[Prev in Thread] Current Thread [Next in Thread]