CVE-2022-31003: Heap-based Buffer Overflow and Out-of-bounds Write in Sofia-SIP
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, rest = record + 2 will access the memory behind \0 and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-31003?
CVE-2022-31003 is a vulnerability in the Sofia-SIP open-source Session Initiation Protocol (SIP) User-Agent library.
What is the severity of CVE-2022-31003?
CVE-2022-31003 has a severity rating of 9.8 (Critical).
How does CVE-2022-31003 impact Sofia-SIP?
CVE-2022-31003 allows an attacker to send a malicious sdp message to FreeSWITCH, causing an out-of-bounds write vulnerability in Sofia-SIP.
Which versions of Sofia-SIP are affected by CVE-2022-31003?
Sofia-SIP versions up to and including 1.12.11+20110422.1 are affected by CVE-2022-31003.
How can I fix CVE-2022-31003 in Sofia-SIP?
To fix CVE-2022-31003, it is recommended to upgrade to version 1.13.8 or later of Sofia-SIP.