CVE-2023-27600: OpenSIPS has vulnerability in the codec_delete_XX() functions

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the deletesdpline function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. \n).

The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions codecdeleteexceptre and codecdeletere. The same issue was also discovered while performing coverage guided fuzzing on the function codecdeleteexceptre. The crash happens because the function deletesdpline expects that an SDP line is terminated by a line feed (\n).

By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function codecdeleteexceptre. Due to the sanity check that is performed in the dellump function, exploitation of this issue will generate an abort in the lumps processing function, resulting in a Denial of Service. This issue is patched in versions 3.1.7 and 3.2.4.