PT-2023-21237 · Opensips · Opensis

Alfredfarrugia + 1 · Publicado 2023-03-15 · Atualizado 2023-03-21 · CVE-2023-27597

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.1.8 and 3.2.5

Description OpenSIPS is a Session Initiation Protocol (SIP) server implementation. When a specially crafted SIP message is processed by the function rewrite ruri, a crash occurs due to a segmentation fault, causing the server to crash. This issue affects configurations containing functions that make use of the affected code, such as the function setport.

Recommendations For versions prior to 3.1.8, update to version 3.1.8 or later. For versions prior to 3.2.5, update to version 3.2.5 or later. As a temporary workaround, consider disabling the rewrite ruri function until a patch is available. Restrict access to configurations containing functions that make use of the affected code, such as the function setport, to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-27597

GHSA-358F-935M-7P9C

Produtos afetados

Opensis

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27597.json · Exploit
• https://github.com/OpenSIPS/opensips/commit/b2dffe4b5cd81182c9c8eabb6c96aac96c7acfe3 · Correção
• https://github.com/OpenSIPS/opensips/security/advisories/GHSA-358f-935m-7p9c · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-27597 · Aviso do Fabricante
• https://t.me/cibsecurity/60088 · Publicação no Telegram
• https://cve.org/CVERecord?id=CVE-2023-27597 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-27597 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-27597 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2023-27597 · Aviso do Fabricante
• https://t.me/cvenotify/46269 · Publicação no Telegram