Vulnerability Details : CVE-2023-27601
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`). The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`): By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2023-27601
- cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*
- cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-27601
0.15%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 51 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-27601
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
NIST | |
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
3.9
|
3.6
|
GitHub, Inc. |
CWE ids for CVE-2023-27601
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: security-advisories@github.com (Secondary)
References for CVE-2023-27601
-
https://github.com/OpenSIPS/opensips/commit/8f87c7c03da55f9c79bd92e67fa2c94b2a7ce5cf
[sipmsgops] fix codec_delete_XX() parsing · OpenSIPS/opensips@8f87c7c · GitHubPatch;Third Party Advisory
-
https://opensips.org/docs/modules/3.3.x/sipmsgops.html
sipmsgops ModuleVendor Advisory
-
https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf
Vendor Advisory
-
https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h
Vulnerability in the codec_delete_XX() functions · Advisory · OpenSIPS/opensips · GitHubThird Party Advisory
Jump to