Re: [Linphone-users] ADSL modem crash when using linphone-2.0.0

[Simon Morlat]

Hi,

Do you have logs (linphone --verbose or linphonec -d 6) for this 64bit parsing 
problem ? I'd like to investigate this problem.
Thanks

Sion

Le Friday 30 November 2007 16:17:01 Alastair Johnson, vous avez écrit :
> I think it's a problem with both. The problem in 64 bit linphone just
> happens to trigger the LiveBox problem.
>
> The LiveBox seems to have a DoS vulnerability. If sent a large number of
> REGISTER requests which never complete then it locks up. This ought to be
> verified and reported, but I'll be surprised if they do anything about it.
>
> Linphone when compiled for x86_64 seems to parse the REGISTER reply
> incorrectly, rejecting valid replies as invalid and resending a REGISTER
> request. It shouldn't misparse in the first place, and it should probably
> rate-limit repeat requests to a server that consistently gives malformed
> replies. I'll try to find out exactly what the problem is, but I've several
> higher priorities at the moment.
>
> On Thursday 29 November 2007, Simon Morlat wrote:
> > Hello,
> >
> > Obviously this is a modem problem.
> > Whatever linphone does, even if it does the worst SIP things of the
> > world, the LiveBox must not crash. It's a major security flaw. Imagine
> > that somebody could decide to crash all livebox of the world simply
> > sending a REGISTER message generated with linphone ? Too easy !
> > My freebox (from the french provider free.fr ) does not crash when I use
> > linphone-2.0.0 (however it has other problems related to ADSL connection,
> > I'm not saying that the freebox is better than Orange's LiveBox).
> > You should report this problem to Orange, I have no doubt that they'll
> > give a try and fix it by updating the firmware.
> >
> > Regards,
> >
> > Simon
> >
> > > Will, I don't believe it's a modem problem, as I mentioned already,
> > > it's logical to think that something wrong with this particular
> > > program, simply because all the other programs I tested do not have any
> > > issues with my modem. Secondly, I'd like to mention that the modem
> > > isn't old and it has build-in VoIP capabilities (but locked to my
> > > provider, so I don't use them), so the modem should be able to handle
> > > VoIP traffic.
> > >
> > > Vladimir.
> > >
> > >
> > >
> > > _______________________________________________
> > > Linphone-users mailing list
> > > address@hidden
> > > http://lists.nongnu.org/mailman/listinfo/linphone-users
> >
> > _______________________________________________
> > Linphone-users mailing list
> > address@hidden
> > http://lists.nongnu.org/mailman/listinfo/linphone-users
>
> _______________________________________________
> Linphone-users mailing list
> address@hidden
> http://lists.nongnu.org/mailman/listinfo/linphone-users