CVE-2023-28098 (published 2023-03-15T23:15Z)

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected way due to a bug in the function `parse_param_name()` . This issue was discovered while performing coverage guided fuzzing of the function parse_msg. The AddressSanitizer identified that the issue occurred in the function `q_memchr()` which is being called by the function `parse_param_name()`. This issue may cause erratic program behaviour or a server crash. It affects configurations containing\nfunctions that make use of the affected code, such as the function `www_authorize()` . Versions 3.1.7 and 3.2.4 contain a fix.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/OpenSIPS/opensips
commit_details: repo_url: https://github.com/OpenSIPS/opensips
author: Liviu Chircu
author_date: 2021-10-27 14:16:48+03:00
msg: parse_param_name(): Improve param parsing macros

Issue discovered during OpenSIPS Security Audit 2021,
    by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-jrqg-vppj-hr2h
repository: repo_url: https://github.com/OpenSIPS/opensips
repo_name: OpenSIPS/opensips
description: OpenSIPS is a GPL implementation of a multi-functionality SIP Server that targets to deliver a high-level technical solution (performance, security and quality) to be used in professional SIP server platforms.
repo_language: C
owner: OpenSIPS
file_changes: filename: param_parser.c
change_type: ModificationType.MODIFY
diff: @@ -72,6 +72,7 @@
 #define READ(val) \
 (*(val + 0) + (*(val + 1) << 8) + (*(val + 2) << 16) + (*(val + 3) << 24))
 
+#define NEED(bytes) do { if (end - p < (bytes)) goto other; } while (0)
 
 #define name_CASE                      \
         switch(LOWER_DWORD(val)) {     \
@@ -83,28 +84,30 @@
 
 
 #define user_CASE         \
-        p += 4;           \
+        p += 4; NEED(4);  \
         val = READ(p);    \
         name_CASE;        \
         goto other;
 
 
 #define real_CASE                         \
-        p += 4;                           \
+        p += 4; NEED(1);                  \
         if (LOWER_BYTE(*p) == 'm') {      \
 		*_type = PAR_REALM;       \
                 p++;                      \
 		goto end;                 \
-	}
+	}                                 \
+        goto other;
 
 
 #define nonc_CASE                         \
-        p += 4;                           \
+        p += 4; NEED(1);                  \
         if (LOWER_BYTE(*p) == 'e') {      \
 	        *_type = PAR_NONCE;       \
                 p++;                      \
 		goto end;                 \
-	}
+	}                                 \
+        goto other;
 
 
 #define onse_CASE                      \
@@ -117,14 +120,14 @@
 
 
 #define resp_CASE         \
-        p += 4;           \
+        p += 4; NEED(4);  \
         val = READ(p);    \
         onse_CASE;        \
         goto other;
 
 
 #define cnon_CASE                                 \
-        p += 4;                                   \
+        p += 4; NEED(2);                          \
         if (LOWER_BYTE(*p) == 'c') {              \
 		p++;                              \
 		if (LOWER_BYTE(*p) == 'e') {      \
@@ -137,7 +140,7 @@
 
 
 #define opaq_CASE                                 \
-        p += 4;                                   \
+        p += 4; NEED(2);                          \
         if (LOWER_BYTE(*p) == 'u') {              \
 		p++;                              \
 		if (LOWER_BYTE(*p) == 'e') {      \
@@ -163,7 +166,7 @@
 
 
 #define algo_CASE         \
-        p += 4;           \
+        p += 4; NEED(5);  \
         val = READ(p);    \
         rith_CASE;        \
         goto other

programming_language: C