PJSIP up to 2.13 nameserver_count heap-based overflow

Summaryinfo

A vulnerability categorized as critical has been discovered in PJSIP up to 2.13. This issue affects the function nameserver_count. The manipulation results in heap-based overflow. This vulnerability is reported as CVE-2023-27585. The attack can be launched remotely. No exploit exists. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in PJSIP up to 2.13. Affected is the function nameserver_count. The manipulation with an unknown input leads to a heap-based overflow vulnerability. CWE is classifying the issue as CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). This is going to have an impact on availability. CVE summarizes:

PJSIP is a free and open source multimedia communication library written in C. A buffer overflow vulnerability in versions 2.13 and prior affects applications that use PJSIP DNS resolver. It doesn't affect PJSIP users who do not utilise PJSIP DNS resolver. This vulnerability is related to CVE-2022-24793. The difference is that this issue is in parsing the query record `parse_query()`, while the issue in CVE-2022-24793 is in `parse_rr()`. A patch is available as commit `d1c5e4d` in the `master` branch. A workaround is to disable DNS resolution in PJSIP config (by setting `nameserver_count` to zero) or use an external resolver implementation instead.

The weakness was disclosed 03/19/2023 as GHSA-p6g5-v97c-w5q4. The advisory is shared for download at github.com. This vulnerability is traded as CVE-2023-27585 since 03/04/2023. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 241238 (Debian dsa-5956 : jami - security update), which helps to determine the existence of the flaw in a target environment.

Applying the patch d1c5e4da5bae7f220bc30719888bb389c905c0c5 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (241238) and EUVD (EUVD-2023-31328). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• PJSIP

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion