SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process.

SIPp 3.6 and earlier contains a local buffer overflow vulnerability in command-line argument handling that allows local attackers to crash the application or execute arbitrary code. Attackers can trigger the vulnerability by supplying oversized input to the -3pcc, -i, or -logfile parameters, causing strcpy to write beyond buffer boundaries in sipp.cpp.

SIPP 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious input in the configuration file. Attackers can craft a configuration file with oversized values that overflow a stack buffer, overwriting the return address and executing arbitrary code through return-oriented programming gadgets.

A NULL pointer dereference vulnerability exists in the SendingMessage function of SIPp v3.7.3. When SIPp processes specially crafted SIP messages replayed during an active call scenario, insufficient validation of internal message structures can lead to dereferencing a NULL pointer, triggering a segmentation fault. This flaw can be reliably reproduced using a malformed SIP proof-of-concept and AFLNet replay tooling. Under certain memory layout and runtime conditions, this crash may be exploitable to achieve local arbitrary code execution, impacting the integrity and availability of the system running SIPp.

Stack-based buffer overflow in the getremotevideoportmedia function in call.cpp in SIPp 3.0 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SIP message. NOTE: some of these details are obtained from third party information.