| タイトル | Kamailio Kamailio SIP Server 6.1.3 (stable, verified) — fixed in PR #4905 (merged 2026-09-08) CWE-120: Buffer Overflow (Static/Global Buffer Overflow) |
|---|
| 説明 | Static Buffer Overflow in Kamailio SIP Server (src/modules/sipt/ss7_parser.c).
The sipt module (SIP-ISUP interworking) of Kamailio SIP Server contains multiple static buffer overflow vulnerabilities in the ISUP message parser. Six parser functions (isup_get_calling_party ss7_parser.c:289, isup_get_called_party :354, isup_get_redirection_number :443, isup_get_redirecting_number :497, isup_get_original_called_number :535, isup_get_generic_number :573) fail to validate the length field of ISUP optional parameters, which is taken directly from the attacker-controlled ISUP body. A value of 0xFF produces a decoded loop count of 253, causing the parser to write up to 507 bytes (506 hex characters plus NUL terminator) into a static 26-byte output buffer (sb_s_buf, sipt.c:319), overflowing it.
An unauthenticated remote attacker can trigger this by sending a SIP INVITE with Content-Type: application/isup containing a crafted ISUP IAM body (12 bytes: 01 00 00 00 00 00 00 01 0A FF 00 00) to the SIP UDP port. No authentication or special privileges are required. The sipt module is not loaded by default but can be loaded at runtime; the overflow is reachable whenever a config references $sipt(calling_party_number).
Confirmed via ASAN on kamailio 6.1.3 stable (official source tarball, core and basic modules with sipt/sl/xlog built with -fsanitize=address):
==272134==ERROR: AddressSanitizer: global-buffer-overflow
WRITE of size 1
#0 isup_get_calling_party src/modules/sipt/ss7_parser.c:302
#1 sipt_get_calling_party src/modules/sipt/sipt.c:328
#2 sipt_get_pv src/modules/sipt/sipt.c:748
The same crash is reproducible identically on 6.0.7 and 6.2.0-dev1 (ASAN builds).
Reported privately to the Kamailio security team on 2026-06-25 via the official security channel. The maintainer (AlexisHadj) reproduced the issue on 2026-09-02 and confirmed the overflow (visible as a large amount of zero data written past the 26-byte buffer in release build). The vendor fixed all six functions in pull request kamailio/kamailio#4905, merged on 2026-09-08 (commit "sipt: Add robust length validations in ISUP message parser").
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (Base 5.3, MEDIUM)
|
|---|
| ソース | ⚠️ https://github.com/kamailio/kamailio/pull/4905 |
|---|
| ユーザー | JerryGW (UID 99144) |
|---|
| 送信 | 2026年09月08日 16:56 (1 月 ago) |
|---|
| モデレーション | 2026年10月11日 12:48 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 416599 [Kamailio 迄 6.0.7/6.1.3 sipt ss7_parser.c isup_get_calling_party length メモリ破損] |
|---|
| ポイント | 20 |
|---|