CVE-2005-1461

Ethereal 0.10.10 - 'SIP' Protocol Dissector Remote Buffer Overflow

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2005-1461 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.

Description

Multiple buffer overflows in the (1) SIP, (2) CMIP, (3) CMP, (4) CMS, (5) CRMF, (6) ESS, (7) OCSP, (8) X.509, (9) ISIS, (10) DISTCC, (11) FCELS, (12) Q.931, (13) NCP, (14) TCAP, (15) ISUP, (16) MEGACO, (17) PKIX1Explitit, (18) PKIX_Qualified, (19) Presentation dissectors in Ethereal before 0.10.11 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Proofs of concept

1

Catalogued exploits

ExploitDBEthereal 0.10.10 - 'SIP' Protocol Dissector Remote Buffer OverflowExploitDB exploitby Team W00dp3ck3rExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This is a remote buffer overflow exploit targeting the SIP protocol dissector in Ethereal 0.10.0 to 0.10.10. It sends a crafted SIP packet over UDP to port 5060, overflowing a buffer in the CSeq method field to overwrite a return address and execute shellcode that adds a user 'su' with password 'su'.

Backdoor review

No backdoor observed in reviewed code

The supplied C source code is a public exploit for CVE-2005-1461 that sends a crafted SIP packet to trigger a buffer overflow in Ethereal's SIP dissector. The payload executes shellcode that adds a user 'su' with password 'su' on the victim host, as described in the code comments. No concealed backdoor, deceptive payload, or operator-directed harm beyond the stated exploit behavior was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesc
Target softwareEthereal
Attack typesbuffer overflowremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The code constructs a malicious payload that overwrites a return address to redirect execution to embedded shellcode, which is the defining characteristic of an exploit. It does not merely detect or report a vulnerability; it actively triggers the overflow and executes attacker-supplied code.

exploits/linux/remote/1021.c:68-73exploits/linux/remote/1021.c:131-132exploits/linux/remote/1021.c:170-179

Requirements

  • Target must be running a vulnerable version of Ethereal (0.10.0 to 0.10.10) with the SIP dissector enabled.exploits/linux/remote/1021.c:3
  • The exploit requires the attacker to know whether the victim started tethereal with a full path or without a directory path, as this affects the pointer address used in the exploit.exploits/linux/remote/1021.c:98-112

Observed behavior

  • Constructs a SIP packet with a malformed CSeq method field that overflows a 16-byte buffer, overwriting the return address with 0xbffee240 and repairing subsequent pointers to maintain execution flow.exploits/linux/remote/1021.c:68-73exploits/linux/remote/1021.c:163-179
  • Embeds shellcode that adds a new user 'su' with password 'su' to the victim system.exploits/linux/remote/1021.c:23exploits/linux/remote/1021.c:53-62
  • Sends the crafted buffer as a UDP packet to port 5060 on the target host.exploits/linux/remote/1021.c:185-186
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Payload
Payload withheldThe shellcode (lines 55-62) and comments (lines 22-23, 53-54) explicitly state the payload adds a user 'su' with password 'su' on the victim host. This is the intended exploit behavior, not a hidden backdoor.exploits/linux/remote/1021.c:22-23exploits/linux/remote/1021.c:53-62
Exploit Mechanism
Payload withheldThe code constructs a SIP packet with a malformed CSeq method (lines 72-73) that overflows a 16-byte buffer, overwriting the return address (line 171) to redirect execution to the shellcode.exploits/linux/remote/1021.c:68-73exploits/linux/remote/1021.c:163-172
Review boundaries

What the analysis did not establish

  • The evidence consists solely of the exploit source code; no network capture, build environment, or target binary is provided.
  • The shellcode is presented as a raw byte array without disassembly or verification of its functionality.
  • The exploit relies on hardcoded memory addresses (0xbffee240, 0xbffee328, 0xbffee338) that are specific to a particular system configuration and may not work on other targets.
  • Only the supplied C source file was reviewed; no external libraries, build artifacts, or network captures were examined.
  • The shellcode is provided as a hex-encoded byte array and was not disassembled or executed; its behavior is taken from the author's comments.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

8