| शीर्षक | OpenSIPS >= 4.0.0, < 4.0.2 and >= 3.6.0, < 3.6.9 rtpproxy: Unauthenticated out-of-bounds read SIP Call-ID din dtm |
|---|
| विवरण | OpenSIPS rtpproxy may perform an out-of-bounds read when constructing a DTMF-catch tag from a SIP Call-ID header.
When rtpproxy_offer() or rtpproxy_answer() is called with the DTMF-catch d/D flag and no dialog identifier is available, rtpproxy falls back to building the DTMF tag from the
request Call-ID. A long attacker-controlled Call-ID could make the computed tag length exceed the fixed stack buffer that stores the tag. That oversized length was then passed to the RTP
proxy transport and used as an iovec length for writev(). |
|---|
| स्रोत | ⚠️ https://github.com/OpenSIPS/opensips/security/advisories/GHSA-qv9x-v8jq-434w |
|---|
| उपयोगकर्ता | nikolak (UID 32609) |
|---|
| सबमिशन | 28/09/2026 12:10 PM (18 दिन पहले) |
|---|
| संयम | 14/10/2026 03:25 PM (16 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 419834 [OpenSIPS तक 3.6.8/4.0.1 rtpproxy rtpproxy_offer/rtpproxy_answer सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|