PT-2023-21242 · Opensips · Opensis
Alfred Farrugia
+1
·
Published
2023-03-15
·
Updated
2023-03-21
·
CVE-2023-27601
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
OpenSIPS versions prior to 3.1.7 and 3.2.4
Description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. The issue arises when a malformed SDP body is received and processed by the
delete sdp line function in the sipmsgops module. This can be reproduced by calling the function with an SDP body that does not terminate with a line feed (i.e., ). The vulnerability was discovered through black-box fuzzing and coverage-guided fuzzing on the codec delete except re function. The crash occurs because the delete sdp line function expects an SDP line to be terminated by a line feed ( ). An attacker can exploit this to crash the server, affecting configurations that rely on the affected code, such as the codec delete except re function. Exploitation results in a Denial of Service due to an abort in the lumps processing function.Recommendations
To resolve the issue, update to version 3.1.7 or 3.2.4, as these versions have fixed the issue.
As a temporary workaround, consider restricting the use of the
delete sdp line function in the sipmsgops module until a patch is available.
Avoid using configurations that rely on the affected code, such as the codec delete except re function, until the issue is resolved.Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Opensis