CVE-2023-27601 OpenSIPS has vulnerability in the codec_delete_XX() functions
An attacker can crash the OpenSIPS server by sending a malformed SDP body, causing a denial of service in configurations using specific codec deletion functions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-27601?
CVE-2023-27601 is a high-severity denial of service vulnerability in opensips, published on 15 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\n`).
The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\n`):
By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.
Weakness: CWE-20
Which versions are affected by CVE-2023-27601?
It affects 1 product.
Products include Opensips Opensips.
How do I fix CVE-2023-27601?
No fix has been published for CVE-2023-27601 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-27601 being exploited?
There is no known exploitation of CVE-2023-27601 in the wild and no public exploit code.
Other vulnerabilities in opensips
- CVE-2023-27596 OpenSIPS has vulnerability in the codec_delete_XX() functions
- CVE-2023-27597 OpenSIPS has vulnerability in the parse_uri() function
- CVE-2023-27598 OpenSIPS has vulnerability in the parse_via() function
- CVE-2023-27599 OpenSIPS has vulnerability in the parse_to_param() function
- CVE-2023-27600 OpenSIPS has vulnerability in the codec_delete_XX() functions
Sources
Also known as GHSA-xj5x-g52f-548h, UBUNTU-CVE-2023-27601.