PT-2017-12151 · Sipcrack+1 · Sipcrack+1

Published 2017-07-26 · Updated 2022-10-06 · CVE-2017-11654

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SIPcrack version 0.2

Description An out-of-bounds read and write flaw was found in the way SIPcrack processed SIP traffic, due to mishandling of 0x00 termination of a payload array. A remote attacker could potentially use this flaw to crash the sipdump process by generating specially crafted SIP traffic.

Recommendations For SIPcrack version 0.2, consider restricting access to the sipdump process until a patch is available to prevent potential crashes caused by specially crafted SIP traffic.

Exploit

Fix

Memory Corruption

Out of bounds Read

Weakness Enumeration

CWE-787

CWE-125

Related Identifiers

CVE-2017-11654

Affected Products

Debian

Sipcrack

References · 9

• 🔥 http://openwall.com/lists/oss-security/2017/07/26/1 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-11654 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-11654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11654 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11654 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-11654 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-11654 · Security Note
• https://ubuntu.com/security/CVE-2017-11654 · Vendor Advisory
• http://securityfocus.com/bid/100023 · Note