CVE-2023-27601 Information

Description

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4 OpenSIPS crashes when a malformed SDP body is received and is processed by the delete_sdp_line function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. \n). The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions codec_delete_except_re and codec_delete_re. The same issue was also discovered while performing coverage guided fuzzing on the function codec_delete_except_re. The crash happens because the function delete_sdp_line expects that an SDP line is terminated by a line feed (\n): By abusing this vulnerability an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code such as the function codec_delete_except_re. Due to the sanity check that is performed in the del_lump function exploitation of this issue will generate an abort in the lumps processing function resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.

Reference

https://github.com/OpenSIPS/opensips/commit/8f87c7c03da55f9c79bd92e67fa2c94b2a7ce5cf https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h https://opensips.org/docs/modules/3.3.x/sipmsgops.html https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf