Tags › Security Advisory

sngrep: stack overflow via malformed SDP connection address

• Fixed versions: 1.4.8
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2020-04-sngrep-malformed-connection-address/
• Reproduction tools: https://github.com/EnableSecurity/advisories/tree/master/ES2020-04-sngrep-malformed-connection-address
• Tested vulnerable versions: 1.4.7
• Timeline:
  • Report date: 2020-09-16
  • sngrep confirmed issue + patch: 2020-09-16
  • sngrep release with fix: 2020-11-10
  • Enable Security advisory: 2020-11-20

Description

When sending a specially crafted SIP message with a malformed SDP connection address, sngrep crashes due to a stack overflow. The following backtrace was generated during our tests:

(gdb) bt
#0  __GI_raise (sig=sig@entry=6)
    at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7ced859 in __GI_abort () at abort.c:79
#2  0x00007ffff7d583ee in __libc_message (
    action=action@entry=do_abort, 
    fmt=fmt@entry=0x7ffff7e8207c "*** %s ***: terminated\n")
    at ../sysdeps/posix/libc_fatal.c:155
#3  0x00007ffff7dfa9ba in __GI___fortify_fail (
    msg=msg@entry=0x7ffff7e82064 "stack smashing detected")
    at fortify_fail.c:26
#4  0x00007ffff7dfa986 in __stack_chk_fail () at stack_chk_fail.c:24
#5  0x0000555555560651 in sip_parse_msg_media (msg=0x7ffff0046c60, 
    payload=<optimized out>) at sip.c:740
#6  0x3131313131313131 in ?? ()
#7  0x3131313131313131 in ?? ()

The issue was originally discovered during OpenSIPIt; tracked down and analyzed for severity and impact later.

Asterisk: crash via INVITE flood over TCP

• Fixed versions: 13.37.1, 16.14.1, 17.8.1, 18.0.1
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2020-02-asterisk-tcp-invite-crash/
• Reproduction tools: https://github.com/EnableSecurity/advisories/tree/master/ES2020-02-asterisk-tcp-invite-crash
• Asterisk Security Advisory: https://downloads.asterisk.org/pub/security/AST-2020-001.html
• References: AST-2020-001, CVE-2020-28327
• Tested vulnerable versions: 17.5.1, 17.6.0
• Timeline:
  • Report date: 2020-08-31
  • Triaged: 2020-09-01
  • Fix provided for testing: 2020-10-29
  • Asterisk release with fix: 2020-11-05
  • Enable Security advisory: 2020-11-06

Description

When an Asterisk instance is flooded with INVITE messages over TCP, it was observed that after some time Asterisk crashes due to a segmentation fault. The backtrace generated after the crash is:

Kamailio: header smuggling via remove_hf bypass

• Fixed versions: Kamailio v5.4.0
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2020-01-kamailio-remove-hf/
• Reproduction tools: https://github.com/EnableSecurity/advisories/tree/master/ES2020-01-kamailio-remove-hf
• References: CVE-2020-28361
• Tested vulnerable versions: 5.3.5 and earlier
• Timeline:
  • Report date & issue patched by Kamailio: 2020-07-16
  • Kamailio rewrite for header parser (better fix): 2020-07-16 to 2020-07-23
  • Kamailio release with fix: 2020-07-29
  • Enable Security advisory: 2020-09-01

Description

Kamailio is often configured to remove certain special internal SIP headers from untrusted traffic to protect against header injection attacks by making use of the remove_hf function from the Kamailio textops module. These SIP headers were typically set through Kamailio which are then used downstream, e.g. by a media service based on Asterisk, to affect internal business logic decisions. During our tests and research, we noticed that the removal of these headers can be bypassed by injecting whitespace characters at the end of the header name.

Kamailio: off-by-one heap overflow

• Authors:
  • Alfred Farrugia alfred@enablesecurity.com
  • Sandro Gauci sandro@enablesecurity.com
• Fixed versions: Kamailio v5.1.2, v5.0.6 and v4.4.7
• References: CVE-2018-8828
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2018-05-kamailio-heap-overflow/
• Kamailio Security Advisory: https://www.kamailio.org/w/2018/03/kamailio-security-announcement-tmx-lcr/
• Tested vulnerable versions: 5.1.1, 5.1.0, 5.0.0
• Timeline:
  • Report date: 2018-02-10
  • Kamailio confirmed issue: 2018-02-10
  • Kamailio patch: 2018-02-10
  • Kamailio release with patch: 2018-03-01
  • Enable Security advisory: 2018-03-19

Description

A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap overflow.

Impact

Abuse of this vulnerability leads to denial of service in Kamailio. Further research may show that exploitation leads to remote code execution.

Asterisk PJSIP: stack corruption via large Accept header in SUBSCRIBE

• Authors:
  • Alfred Farrugia alfred@enablesecurity.com
  • Sandro Gauci sandro@enablesecurity.com
• Latest vulnerable version: Asterisk 15.2.0 running chan_pjsip
• Tested vulnerable versions: 15.2.0, 13.19.0, 14.7.5, 13.11.2
• References: AST-2018-004, CVE-2018-7284
• Advisory URL: https://www.enablesecurity.com/advisories/ES2018-01-asterisk-pjsip-subscribe-stack-corruption/
• Vendor Advisory: http://downloads.asterisk.org/pub/security/AST-2018-004.html
• Timeline:
  • Issue reported to vendor: 2018-01-30
  • Vendor patch made available to us: 2018-02-06
  • Vendor advisory published: 2018-02-21
  • Enable Security advisory: 2018-02-22

Description

A large SUBSCRIBE message with multiple malformed Accept headers will crash Asterisk due to stack corruption.

Impact

Abuse of this vulnerability leads to denial of service in Asterisk when chan_pjsip is in use. Brief analysis indicates that this is an exploitable vulnerability that may lead to remote code execution.

Asterisk PJSIP: crash via repeated INVITE messages over TCP/TLS

• Authors:
  • Alfred Farrugia alfred@enablesecurity.com
  • Sandro Gauci sandro@enablesecurity.com
• Latest vulnerable version: Asterisk 15.2.0 running chan_pjsip installed with --with-pjproject-bundled
• References: AST-2018-005, CVE-2018-7286
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2018-04-asterisk-pjsip-tcp-segfault/
• Vendor Advisory: http://downloads.asterisk.org/pub/security/AST-2018-005.html
• Tested vulnerable versions: 15.2.0, 15.1.0, 15.0.0, 13.19.0, 13.11.2, 14.7.5
• Timeline:
  • Issue reported to vendor: 2018-01-24
  • Vendor patch made available to us: 2018-02-05
  • Vendor advisory published: 2018-02-21
  • Enable Security advisory: 2018-02-22

Description

A crash occurs when a number of INVITE messages are sent over TCP or TLS and then the connection is suddenly closed. This issue leads to a segmentation fault.

Asterisk PJSIP: crash via invalid SDP media format description

• Authors:
  • Alfred Farrugia alfred@enablesecurity.com
  • Sandro Gauci sandro@enablesecurity.com
• Latest vulnerable version: Asterisk 15.2.0 running chan_pjsip
• References: AST-2018-002, CVE-2018-1000098
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2018-03-asterisk-pjsip-sdp-invalid-media-format-description-segfault/
• Vendor Advisory: http://downloads.asterisk.org/pub/security/AST-2018-002.html
• Tested vulnerable versions: 13.10.0, 15.1.3, 15.1.4, 15.1.5, 15.2.0
• Timeline:
  • Report date: 2018-01-15
  • Vendor patch made available to us: 2018-02-05
  • Vendor advisory published: 2018-02-21
  • Enable Security advisory: 2018-02-22

Description

A specially crafted SDP message body with an invalid media format description causes a segmentation fault in asterisk using chan_pjsip.

Impact

Abuse of this vulnerability leads to denial of service in Asterisk when chan_pjsip is in use.

Asterisk PJSIP: crash via invalid SDP fmtp attribute

• Authors:
  • Alfred Farrugia alfred@enablesecurity.com
  • Sandro Gauci sandro@enablesecurity.com
• Latest vulnerable version: Asterisk 15.2.0 running chan_pjsip
• References: AST-2018-003, CVE-2018-1000099
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2018-02-asterisk-pjsip-sdp-invalid-fmtp-segfault/
• Vendor Advisory: http://downloads.asterisk.org/pub/security/AST-2018-003.html
• Timeline:
  • Issue reported to vendor: 2018-01-15
  • Vendor patch made available to us: 2018-02-05
  • Vendor advisory published: 2018-02-21
  • Enable Security advisory: 2018-02-22

Description

A specially crafted SDP message body with an invalid fmtp attribute causes a segmentation fault in asterisk using chan_pjsip.

Impact

Abuse of this vulnerability leads to denial of service in Asterisk when chan_pjsip is in use.

Asterisk: RTP Bleed vulnerability

• Authors:
  • Klaus-Peter Junghanns kapejod@gmail.com
  • Sandro Gauci sandro@enablesecurity.com
• Vulnerable version: Asterisk 11.4.0 to 14.6.1 (fix incomplete)
• References: AST-2017-005, AST-2017-008, CVE-2017-14099
• Advisory URL: https://www.enablesecurity.com/advisories/ES2017-04-asterisk-rtp-bleed/
• Timeline:
  • First report date: 2011-09-11
  • Fix applied: 2011-09-21
  • Issue apparently reintroduced: 2013-03-07
  • New report date: 2017-05-17
  • Vendor patch provided for testing: 2017-05-23
  • Vendor advisory: 2017-08-31
  • Enable Security advisory: 2017-09-01
  • Vendor updated advisory: 2017-09-19

Description

When Asterisk is configured with the nat=yes and strictrtp=yes (on by default) options, it is vulnerable to an attack which we call RTP Bleed. Further information about the attack can be found at https://rtpbleed.com.

Asterisk PJSIP: heap overflow in CSeq header parsing

• Authors:
  • Alfred Farrugia alfred@enablesecurity.com
  • Sandro Gauci sandro@enablesecurity.com
• Vulnerable version: Asterisk 14.4.0 running chan_pjsip, PJSIP 2.6
• References: AST-2017-002, CVE-2017-9372
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2017-01-asterisk-pjsip-cseq-overflow/
• Vendor Advisory: http://downloads.asterisk.org/pub/security/AST-2017-002.html
• Timeline:
  • Report date: 2017-04-12
  • Digium confirmed issue: 2017-04-12
  • Digium patch and advisory: 2017-05-19
  • PJSIP added patch by Digium: 2017-05-21
  • Enable Security advisory: 2017-05-23

Description

A specially crafted SIP message with a long CSEQ value will cause a heap overflow in PJSIP.

Impact

Abuse of this vulnerability leads to denial of service in Asterisk when chan_pjsip is in use. This vulnerability is likely to be abused for remote code execution and may affect other code that makes use of PJSIP.