PT-2022-2681 · Pjsip+4 · Pjsip+4

Arasht94 + 2 · Published 2022-03-22 · Updated 2024-11-25 · CVE-2022-24764

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions PJSIP versions 2.12 and prior

Description The issue is related to a stack buffer overflow vulnerability in the PJSIP multimedia communication library, specifically affecting users of PJSUA2 or those who call the API endpoints pjmedia sdp print() and pjmedia sdp media print(). This vulnerability can be exploited by a remote attacker to execute arbitrary code or cause a denial of service. Applications not using PJSUA2 and not directly calling pjmedia sdp print() or pjmedia sdp media print() are not affected.

Recommendations For PJSIP versions 2.12 and prior, a patch is available on the master branch of the pjsip/pjproject GitHub repository. As a temporary workaround, consider disabling the pjmedia sdp print() and pjmedia sdp media print() functions until a patch is applied. Restrict access to the PJSUA2 API to minimize the risk of exploitation.

Exploit

Fix

Memory Corruption

Stack Overflow

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-121

CWE-120

Related Identifiers

ALT-PU-2024-15954

ALT-PU-2024-16030

BDU:2022-03171

CVE-2022-24764

DLA-2962-1

DLA-3194-1

DLA-3549-1

DLA-3887-1

DSA-5285-1

GHSA-F5QG-PQCG-765M

USN-6422-1

Affected Products

Alt Linux

Linuxmint

Pjsip

Red Os

Ubuntu

References · 52

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24764.json · Exploit
• https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00 · Patch
• https://github.com/pjsip/pjproject/security/advisories/GHSA-f5qg-pqcg-765m · Patch
• https://osv.dev/vulnerability/USN-6422-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-24754 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2962-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-39244 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-24764 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24764 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-21723 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-23547 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03171 · Security Note
• https://ubuntu.com/security/CVE-2022-21722 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3194-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-31031 · Vendor Advisory