OpenSIPS crashes when a malformed SDP body is received and is processed by the delete_sdp_line function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. \n).
The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions codec_delete_except_re and codec_delete_re. The same issue was also discovered while performing coverage guided fuzzing on the function codec_delete_except_re. The crash happens because the function delete_sdp_line expects that
an SDP line is terminated by a line feed (\n):
Impact
By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function codec_delete_except_re.
Due to the sanity check that is performed in the del_lump function, exploitation of this issue will generate an abort in the lumps processing function, resulting in a Denial of Service.
Patches
This issue has been fixed by commit c6ab3bb.
References
Read more about this issue in the Audit Document section 3.3.
For more information
If you have any questions or comments about this advisory:
sandrogauci Analyst
alfredfarrugia Analyst
OpenSIPS crashes when a malformed SDP body is received and is processed by the
delete_sdp_linefunction in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e.\n).The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions
codec_delete_except_reandcodec_delete_re. The same issue was also discovered while performing coverage guided fuzzing on the functioncodec_delete_except_re. The crash happens because the functiondelete_sdp_lineexpects thatan SDP line is terminated by a line feed (
\n):Impact
By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function
codec_delete_except_re.Due to the sanity check that is performed in the
del_lumpfunction, exploitation of this issue will generate anabortin the lumps processing function, resulting in a Denial of Service.Patches
This issue has been fixed by commit c6ab3bb.
References
Read more about this issue in the Audit Document section 3.3.
For more information
If you have any questions or comments about this advisory: