USN-6448-1: Sofia-SIP vulnerability
Published Oct 24, 2023
·Updated
Xu Biang discovered that Sofia-SIP did not properly manage memory when handling STUN packets. An attacker could use this issue to cause Sofia-SIP to crash, resulting in a denial of service, or possibly execute arbitrary code.
Affected Software
36 affected componentsFixes available
All of the following
ubuntu/libsofia-sip-ua-glib3<1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.10.1
1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/libsofia-sip-ua0<1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.10.1
1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/sofia-sip-bin<1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.10.1
1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.10.1
Ubuntu Ubuntu=23.10
All of the following
ubuntu/libsofia-sip-ua-glib3<1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.04.1
1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/libsofia-sip-ua0<1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.04.1
1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/sofia-sip-bin<1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.04.1
1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.04.1
Ubuntu Ubuntu=23.04
All of the following
ubuntu/libsofia-sip-ua-glib3<1.12.11+20110422.1-2.1+deb10u3ubuntu0.22.04.2
1.12.11+20110422.1-2.1+deb10u3ubuntu0.22.04.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libsofia-sip-ua0<1.12.11+20110422.1-2.1+deb10u3ubuntu0.22.04.2
1.12.11+20110422.1-2.1+deb10u3ubuntu0.22.04.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/sofia-sip-bin<1.12.11+20110422.1-2.1+deb10u3ubuntu0.22.04.2
1.12.11+20110422.1-2.1+deb10u3ubuntu0.22.04.2
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libsofia-sip-ua-glib3<1.12.11+20110422.1-2.1+deb10u3ubuntu0.20.04.2
1.12.11+20110422.1-2.1+deb10u3ubuntu0.20.04.2
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libsofia-sip-ua0<1.12.11+20110422.1-2.1+deb10u3ubuntu0.20.04.2
1.12.11+20110422.1-2.1+deb10u3ubuntu0.20.04.2
Ubuntu Ubuntu=20.04
All of the following
ubuntu/sofia-sip-bin<1.12.11+20110422.1-2.1+deb10u3ubuntu0.20.04.2
1.12.11+20110422.1-2.1+deb10u3ubuntu0.20.04.2
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libsofia-sip-ua-glib3<1.12.11+20110422.1-2.1+deb10u3ubuntu0.18.04.1~esm1
1.12.11+20110422.1-2.1+deb10u3ubuntu0.18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libsofia-sip-ua0<1.12.11+20110422.1-2.1+deb10u3ubuntu0.18.04.1~esm1
1.12.11+20110422.1-2.1+deb10u3ubuntu0.18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/sofia-sip-bin<1.12.11+20110422.1-2.1+deb10u3ubuntu0.18.04.1~esm1
1.12.11+20110422.1-2.1+deb10u3ubuntu0.18.04.1~esm1
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libsofia-sip-ua-glib3<1.12.11+20110422.1-2.1+deb10u3ubuntu0.16.04.1~esm2
1.12.11+20110422.1-2.1+deb10u3ubuntu0.16.04.1~esm2
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libsofia-sip-ua0<1.12.11+20110422.1-2.1+deb10u3ubuntu0.16.04.1~esm2
1.12.11+20110422.1-2.1+deb10u3ubuntu0.16.04.1~esm2
Ubuntu Ubuntu=16.04
All of the following
ubuntu/sofia-sip-bin<1.12.11+20110422.1-2.1+deb10u3ubuntu0.16.04.1~esm2
1.12.11+20110422.1-2.1+deb10u3ubuntu0.16.04.1~esm2
Ubuntu Ubuntu=16.04
Event History
Oct 24, 2023
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the vulnerability ID for the Sofia-SIP vulnerability?
The vulnerability ID for the Sofia-SIP vulnerability is USN-6448-1.
2
What is the impact of the Sofia-SIP vulnerability?
The Sofia-SIP vulnerability can result in a denial of service or allow an attacker to execute arbitrary code.
3
How does an attacker exploit the Sofia-SIP vulnerability?
An attacker can exploit the Sofia-SIP vulnerability by sending specially crafted STUN packets.
4
Which versions of Ubuntu are affected by the Sofia-SIP vulnerability?
The Sofia-SIP vulnerability affects Ubuntu versions 23.10, 23.04, 22.04, 20.04, 18.04, and 16.04.
5
How can I fix the Sofia-SIP vulnerability?
To fix the Sofia-SIP vulnerability, update to version 1.12.11+20110422.1+1e14eea~dfsg-4ubuntu1.23.10.1 for Ubuntu 23.10, or the respective updated versions for other affected Ubuntu versions.