OpenSIPS up to 3.1.6/3.2.3 SDP Body delete_sdp_line denial of service

Summaryinfo

A vulnerability was found in OpenSIPS up to 3.1.6/3.2.3 and classified as problematic. The impacted element is the function delete_sdp_line of the component SDP Body Handler. The manipulation results in denial of service. This vulnerability is cataloged as CVE-2023-27601. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in OpenSIPS up to 3.1.6/3.2.3. Affected is the function delete_sdp_line of the component SDP Body Handler. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. CVE summarizes:

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`). The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`): By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.

The weakness was shared 03/16/2023 as GHSA-xj5x-g52f-548h. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-27601 since 03/04/2023. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 3.1.7 or 3.2.4 eliminates this vulnerability. Applying the patch 8f87c7c03da55f9c79bd92e67fa2c94b2a7ce5cf is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Name

• OpenSIPS

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3

License

• open-source

Website

• Product: https://github.com/OpenSIPS/opensips/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion