OpenSIPS up to 3.1.6/3.2.3 Header calc_tag_suffix Via uninitialized resource

Summaryinfo

A vulnerability labeled as critical has been found in OpenSIPS up to 3.1.6/3.2.3. This affects the function calc_tag_suffix of the component Header Handler. The manipulation of the argument Via results in uninitialized resource. This vulnerability is known as CVE-2023-27598. It is possible to launch the attack remotely. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in OpenSIPS up to 3.1.6/3.2.3. It has been classified as critical. Affected is the function calc_tag_suffix of the component Header Handler. The manipulation of the argument Via with an unknown input leads to a uninitialized resource vulnerability. CWE is classifying the issue as CWE-908. The product uses or accesses a resource that has not been initialized. This is going to have an impact on availability. CVE summarizes:

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed `Via` header to OpenSIPS triggers a segmentation fault when the function `calc_tag_suffix` is called. A specially crafted `Via` header, which is deemed correct by the parser, will pass uninitialized strings to the function `MD5StringArray` which leads to the crash. Abuse of this vulnerability leads to Denial of Service due to a crash. Since the uninitialized string points to memory location `0x0`, no further exploitation appears to be possible. No special network privileges are required to perform this attack, as long as the OpenSIPS configuration makes use of functions such as `sl_send_reply` or `sl_gen_totag` that trigger the vulnerable code. This issue has been fixed in versions 3.1.7 and 3.2.4.

The weakness was published 03/16/2023 as GHSA-wxfg-3gwh-rhvx. The advisory is available at github.com. This vulnerability is traded as CVE-2023-27598 since 03/04/2023. Technical details are known, but there is no available exploit.

Upgrading to version 3.1.7 or 3.2.4 eliminates this vulnerability. Applying the patch ab611f74f69d9c42be5401c40d56ea06a58f5dd7 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• OpenSIPS

Version

• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.2.0
• 3.2.1
• 3.2.2
• 3.2.3

License

• open-source

Website

• Product: https://github.com/OpenSIPS/opensips/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion