OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, if dsisinlist() is used with an invalid IP address string (NULL is illegal input), OpenSIPS will attempt to print a string from a random address (stack garbage), which could lead to a crash. All users of dsisinlist() without the $si variable as 1st parameter could be affected by this vulnerability to a larger, lesser or no extent at all, depending if the data passed to the function is a valid IPv4 or IPv6 address string or not. Fixes will are available starting with the 3.1.9 and 3.2.6 minor releases. There are no known workarounds.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, a specially crafted Authorization header causes OpenSIPS to crash or behave in an unexpected way due to a bug in the function parseparamname() . This issue was discovered while performing coverage guided fuzzing of the function parsemsg. The AddressSanitizer identified that the issue occurred in the function qmemchr() which is being called by the function parseparamname(). This issue may cause erratic program behaviour or a server crash. It affects configurations containing functions that make use of the affected code, such as the function wwwauthorize() . Versions 3.1.7 and 3.2.4 contain a fix.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.9 and 3.2.6, a malformed SIP message containing a large Content-Length value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the -m flag was allocated to OpenSIPS, such as 10 GB of RAM. On the test system, this issue occurred when shared memory was set to 2362 or higher. This issue is fixed in versions 3.1.9 and 3.2.6. The only workaround is to guarantee that the Content-Length value of input messages is never larger than 2147483647.

OpenSIPS, a Session Initiation Protocol (SIP) server implementation, has a memory leak starting in the 2.3 branch and priot to versions 3.1.8 and 3.2.5. The memory leak was detected in the function parsemirequest while performing coverage-guided fuzzing. This issue can be reproduced by sending multiple requests of the form {"jsonrpc": "2.0","method": "logle. This malformed message was tested against an instance of OpenSIPS via FIFO transport layer and was found to increase the memory consumption over time.

To abuse this memory leak, attackers need to reach the management interface (MI) which typically should only be exposed on trusted interfaces. In cases where the MI is exposed to the internet without authentication, abuse of this issue will lead to memory exhaustion which may affect the underlying system’s availability. No authentication is typically required to reproduce this issue. On the other hand, memory leaks may occur in other areas of OpenSIPS where the cJSON library is used for parsing JSON objects.

The issue has been fixed in versions 3.1.8 and 3.2.5.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.1.7 and 3.2.4 have a potential issue in msgtranslator.c:2628 which might lead to a server crash. This issue was found while fuzzing the function buildresbuffromsipreq but could not be reproduced against a running instance of OpenSIPS. This issue could not be exploited against a running instance of OpenSIPS since no public function was found to make use of this vulnerable code. Even in the case of exploitation through unknown vectors, it is highly unlikely that this issue would lead to anything other than Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the deletesdpline function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. \n).

The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions codecdeleteexceptre and codecdeletere. The same issue was also discovered while performing coverage guided fuzzing on the function codecdeleteexceptre. The crash happens because the function deletesdpline expects that an SDP line is terminated by a line feed (\n):

By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function codecdeleteexceptre. Due to the sanity check that is performed in the dellump function, exploitation of this issue will generate an abort in the lumps processing function, resulting in a Denial of Service. This issue has been fixed in versions 3.1.7 and 3.2.4.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the deletesdpline function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. \n).

The vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions codecdeleteexceptre and codecdeletere. The same issue was also discovered while performing coverage guided fuzzing on the function codecdeleteexceptre. The crash happens because the function deletesdpline expects that an SDP line is terminated by a line feed (\n).

By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function codecdeleteexceptre. Due to the sanity check that is performed in the dellump function, exploitation of this issue will generate an abort in the lumps processing function, resulting in a Denial of Service. This issue is patched in versions 3.1.7 and 3.2.4.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, when the function appendhf handles a SIP message with a malformed To header, a call to the function abort() is performed, resulting in a crash. This is due to the following check in datalump.c:399 in the function anchorlump. An attacker abusing this vulnerability will crash OpenSIPS leading to Denial of Service. It affects configurations containing functions that make use of the affected code, such as the function appendhf. This issue has been fixed in versions 3.1.7 and 3.2.4.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, sending a malformed Via header to OpenSIPS triggers a segmentation fault when the function calctagsuffix is called. A specially crafted Via header, which is deemed correct by the parser, will pass uninitialized strings to the function MD5StringArray which leads to the crash. Abuse of this vulnerability leads to Denial of Service due to a crash. Since the uninitialized string points to memory location 0x0, no further exploitation appears to be possible. No special network privileges are required to perform this attack, as long as the OpenSIPS configuration makes use of functions such as slsendreply or slgentotag that trigger the vulnerable code. This issue has been fixed in versions 3.1.7 and 3.2.4.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, when a specially crafted SIP message is processed by the function rewriteruri, a crash occurs due to a segmentation fault. This issue causes the server to crash. It affects configurations containing functions that make use of the affected code, such as the function setport. This issue has been fixed in version 3.1.8 and 3.2.5.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.8 and 3.2.5, OpenSIPS crashes when a malformed SDP body is sent multiple times to an OpenSIPS configuration that makes use of the streamprocess function. This issue was discovered during coverage guided fuzzing of the function codecdeleteexceptre. By abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function codecdeleteexceptre. This issue has been fixed in version 3.1.8 and 3.2.5.

A Denial of Service (infinite loop) exists in OpenSIPS before 1.10 in lookup.c.