7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
0.001 Low
EPSS
Percentile
44.1%
OpenSIPS is a Session Initiation Protocol (SIP) server implementation.
Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP
body is received and is processed by the delete_sdp_line
function in the
sipmsgops module. This issue can be reproduced by calling the function with
an SDP body that does not terminate by a line feed (i.e. \n
). The
vulnerability was found while performing black-box fuzzing against an
OpenSIPS server running a configuration that made use of the functions
codec_delete_except_re
and codec_delete_re
. The same issue was also
discovered while performing coverage guided fuzzing on the function
codec_delete_except_re
. The crash happens because the function
delete_sdp_line
expects that an SDP line is terminated by a line feed
(\n
). By abusing this vulnerability, an attacker is able to crash the
server. It affects configurations containing functions that rely on the
affected code, such as the function codec_delete_except_re
. Due to the
sanity check that is performed in the del_lump
function, exploitation of
this issue will generate an abort
in the lumps processing function,
resulting in a Denial of Service. This issue is patched in versions 3.1.7
and 3.2.4.
github.com/OpenSIPS/opensips/commit/c6ab3bb406c447e30c7d33a1a8970048b4612100
github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx
launchpad.net/bugs/cve/CVE-2023-27600
nvd.nist.gov/vuln/detail/CVE-2023-27600
opensips.org/docs/modules/3.3.x/sipmsgops.html
opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
security-tracker.debian.org/tracker/CVE-2023-27600
www.cve.org/CVERecord?id=CVE-2023-27600