CVE-2023-27601 (published 2023-03-15T22:15Z)

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\\n`).\n\nThe vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\\n`):\n\nBy abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/OpenSIPS/opensips
commit_details: repo_url: https://github.com/OpenSIPS/opensips
author: Bogdan-Andrei Iancu
author_date: 2021-11-11 15:33:30+02:00
msg: [sipmsgops] fix codec_delete_XX() parsing

Issue discovered during OpenSIPS Security Audit 2021,
        by Alfred Farrugia & Sandro Gauci (Enable Security)

https://github.com/OpenSIPS/opensips/security/advisories/GHSA-xj5x-g52f-548h
repository: repo_url: https://github.com/OpenSIPS/opensips
repo_name: OpenSIPS/opensips
description: OpenSIPS is a GPL implementation of a multi-functionality SIP Server that targets to deliver a high-level technical solution (performance, security and quality) to be used in professional SIP server platforms.
repo_language: C
owner: OpenSIPS
file_changes: filename: codecs.c
change_type: ModificationType.MODIFY
diff: @@ -347,7 +347,10 @@ static int do_for_all_streams(struct sip_msg* msg, str* str1,str * str2,
 }
 
 
-int delete_sdp_line( struct sip_msg * msg, char * s)
+/* deletes a SDP line (from a stream) by giving a pointer within the line.
+ * The stream is used to safeguard the identification of the line boundries.
+ */
+int delete_sdp_line( struct sip_msg * msg, char * s, struct sdp_stream_cell *stream)
 {
 	char * start,*end;
 
@@ -357,11 +360,11 @@ int delete_sdp_line( struct sip_msg * msg, char * s)
 	start = s;
 	end  = s;
 
-	while(*start != '\n')
+	while(*start != '\n' && start > stream->body.s)
 		start--;
 	start++;
 
-	while(*end != '\n')
+	while(*end != '\n' && end < (stream->body.s+stream->body.len) )
 		end++;
 	end++;
 
@@ -530,14 +533,14 @@ static int stream_process(struct sip_msg * msg, struct sdp_stream_cell *cell,
 				{
 					/* find the full 'a=...' entry */
 
-					if( delete_sdp_line( msg, payload->rtp_enc.s) < 0 )
+					if( delete_sdp_line( msg, payload->rtp_enc.s, cell) < 0 )
 					{
 						LM_ERR("Unable to add delete lump for a=\n");
 						ret = -1;
 						goto end;
 					}
 
-					if( delete_sdp_line( msg, payload->fmtp_string.s) < 0 )
+					if( delete_sdp_line( msg, payload->fmtp_string.s, cell) < 0 )
 					{
 						LM_ERR("Unable to add delete lump for a=\n");
 						ret = -1;

programming_language: C