Tags › CVE-2021-1000005
VoIPmonitor: buffer overflow in live sniffer
Published on Mar 15, 2021 in CVE-2021-1000005, voipmonitor, buffer overflow, denial of service, memory corruption, security advisory
- Fixed versions: 27.6
- Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2021-03-voipmonitor-livesniffer-buffer-overflow/
- VoIPmonitor Security Advisory: none, changelog references fixes at https://www.voipmonitor.org/changelog-sniffer
- Tested vulnerable versions: 27.5
- References: CVE-2021-1000005
- Timeline:
- Report date: 2021-02-10
- Triaged: 2021-02-12
- Fix provided for testing: 2021-02-15
- VoIPmonitor release with fix: 2021-02-15
- Enable Security advisory: 2021-03-15
Description
A buffer overflow was identified in the VoIPmonitor live sniffer feature. The description variable in the function save_packet_sql is defined as a fixed length array of 1024 characters. The description is set to the value of a SIP request or response line. By setting a long request or response line VoIPmonitor will trigger a buffer overflow. The affected code is:
