Exploitation Summary
EIP tracks 7 public exploits for CVE-2006-3524.
PoCs published by Metasploit, Michael Thumann, including Metasploit module exploits/windows/sip/aim_triton_cseq.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow in SIPfoundry sipXphone 2.6.0.27 by sending an overly long CSeq value via UDP, leading to arbitrary code execution.
Description
Buffer overflow in SIPfoundry sipXtapi released before 20060324 allows remote attackers to execute arbitrary code via a long CSeq field value in an INVITE message.
Exploits (7)
This Metasploit module exploits a buffer overflow in SIPfoundry sipXphone 2.6.0.27 by sending an overly long CSeq value via UDP, leading to arbitrary code execution.
This Metasploit module exploits a buffer overflow in SIPfoundry's sipXezPhone 0.35a by sending a maliciously crafted SIP INVITE request with an overly long CSeq header, leading to arbitrary code execution.
This exploit targets a buffer overflow in AIM Triton 1.0.4 by sending a maliciously crafted SIP INVITE request with an overly long CSeq value, leading to arbitrary code execution via SEH overwrite.
This Perl script exploits a remote buffer overflow in sipXtapi by sending a maliciously crafted SIP INVITE packet to UDP port 5060. The exploit overwrites the EIP register with a controlled pattern, demonstrating the vulnerability.
This Metasploit module exploits a buffer overflow in AIM Triton 1.0.4 by sending a maliciously crafted SIP INVITE request with an overly long CSeq value, leading to arbitrary code execution. The exploit leverages SEH overwrites and includes a payload delivery mechanism.
This Metasploit module exploits a buffer overflow in SIPfoundry's sipXezPhone 0.35a by sending a maliciously crafted SIP INVITE request with an overly long CSeq header, leading to arbitrary code execution. The exploit uses a UDP-based attack vector and includes SEH (Structured Exception Handler) bypass techniques to achieve reliable exploitation.
This Metasploit module exploits a buffer overflow in SIPfoundry sipXphone 2.6.0.27 by sending a maliciously crafted SIP INVITE request with an overly long CSeq value, leading to arbitrary code execution.