PT-2013-1308 · Asipto · Kamailio

Helmut Grohne · Published 2013-06-12 · Updated 2017-09-02 · CVE-2013-7426

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions kamailio version 4.0.1

Description The issue is related to an insecure temporary file vulnerability. It also involves an unlimited file upload vulnerability of a dangerous type in the SIP server, which can be exploited by a remote attacker to upload or transfer untrusted files to the /tmp/kamailio fifo location.

Recommendations For kamailio version 4.0.1, consider restricting access to the /tmp/kamailio fifo directory to prevent exploitation. Additionally, as a temporary workaround, restrict the ability to upload files to this location until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2017-02019

CVE-2013-7426

Affected Products

Kamailio

References · 11

• https://ubuntu.com/security/CVE-2013-7426 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-7426 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02019 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-7426 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-7426 · Security Note
• https://cve.org/CVERecord?id=CVE-2013-7426 · Security Note
• http://openwall.com/lists/oss-security/2015/02/12/7 · Patch
• https://security-tracker.debian.org/tracker/CVE-2013-7426 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-7426 · Vendor Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=712083 · Note
• http://securityfocus.com/bid/100537 · Note