PT-2006-7473 · Openser · Openser

Published 2006-12-31 · Updated 2018-10-17 · CVE-2006-6876

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: OpenSER versions 1.2.0 and earlier

Description: A buffer overflow issue exists in the fetchsms function within the SMS handling module, specifically in the libsms getsms.c file. This issue allows remote attackers to cause a denial of service by crashing the system through a crafted SMS message. The crash occurs due to memory corruption when the "beginning" buffer is copied to the third argument, pdu.

Recommendations: For OpenSER versions 1.2.0 and earlier, as a temporary workaround, consider disabling the SMS handling module until a patch is available. Restrict access to the libsms getsms.c file to minimize the risk of exploitation. Avoid processing crafted SMS messages in the affected module until the issue is resolved.

Fix

Related Identifiers

CVE-2006-6876

Affected Products

Openser

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2006-6876 · Security Note
• http://archives.neohapsis.com/archives/bugtraq/2007-01/0093.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31137 · Note
• http://osvdb.org/33340 · Note
• http://securityfocus.com/bid/21800 · Note
• http://securityfocus.com/archive/1/455415/100/0/threaded · Note