Headline
CVE-2023-27601: [sipmsgops] fix codec_delete_XX() parsing · OpenSIPS/opensips@8f87c7c
OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the delete_sdp_line function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. \n). The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions codec_delete_except_re and codec_delete_re. The same issue was also discovered while performing coverage guided fuzzing on the function codec_delete_except_re. The crash happens because the function delete_sdp_line expects that an SDP line is terminated by a line feed (\n): By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function codec_delete_except_re. Due to the sanity check that is performed in the del_lump function, exploitation of this issue will generate an abort in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.
@@ -347,7 +347,10 @@ static int do_for_all_streams(struct sip_msg* msg, str* str1,str * str2,
}
int delete_sdp_line( struct sip_msg * msg, char * s)
/* deletes a SDP line (from a stream) by giving a pointer within the line.
* The stream is used to safeguard the identification of the line boundries.
*/
int delete_sdp_line( struct sip_msg * msg, char * s, struct sdp_stream_cell *stream)
{
char * start,*end;
@@ -357,11 +360,11 @@ int delete_sdp_line( struct sip_msg * msg, char * s)
start = s;
end = s;
while(*start != ‘\n’)
while(*start != ‘\n’ && start > stream->body.s)
start–;
start++;
while(*end != ‘\n’)
while(*end != ‘\n’ && end < (stream->body.s+stream->body.len) )
end++;
end++;
@@ -530,14 +533,14 @@ static int stream_process(struct sip_msg * msg, struct sdp_stream_cell *cell,
{
/* find the full ‘a=…’ entry */
if( delete_sdp_line( msg, payload->rtp_enc.s) < 0 )
if( delete_sdp_line( msg, payload->rtp_enc.s, cell) < 0 )
{
LM_ERR(“Unable to add delete lump for a=\n”);
ret = -1;
goto end;
}
if( delete_sdp_line( msg, payload->fmtp_string.s) < 0 )
if( delete_sdp_line( msg, payload->fmtp_string.s, cell) < 0 )
{
LM_ERR(“Unable to add delete lump for a=\n”);
ret = -1;