PT-2023-21555 · Opensips · Opensis

Alfred Farrugia + 1 · Publicado 2023-03-15 · Atualizado 2023-03-21 · CVE-2023-28095

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenSIPS versions prior to 3.1.7 OpenSIPS versions prior to 3.2.4

Description OpenSIPS is a Session Initiation Protocol (SIP) server implementation. The issue is located in msg translator.c:2628 and might lead to a server crash. This issue was found while fuzzing the function build res buf from sip req but could not be reproduced against a running instance of OpenSIPS. It is highly unlikely that this issue would lead to anything other than Denial of Service, even in the case of exploitation through unknown vectors.

Recommendations For versions prior to 3.1.7, update to version 3.1.7 or later. For versions prior to 3.2.4, update to version 3.2.4 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2023-28095

GHSA-7PF3-24QG-8V9H

Produtos afetados

Opensis

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28095.json · Exploit
• https://github.com/OpenSIPS/opensips/security/advisories/GHSA-7pf3-24qg-8v9h · Nota
• https://github.com/OpenSIPS/opensips/commit/9cf3dd3398719dd91207495f76d7726701c5145c · Correção
• https://ubuntu.com/security/CVE-2023-28095 · Aviso do Fabricante
• https://t.me/cvenotify/46274 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28095 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-28095 · Nota de Segurança
• https://t.me/cvenotify/46313 · Publicação no Telegram
• https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2023-28095 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-28095 · Aviso do Fabricante