Sandro Gauci

O rtpengine é suscetível a injeção de RTP e redirecionamento de mídia, potencialmente levando a uma condição de negação de serviço (DoS). O vazamento de RTP (RTP bleed) permite que um atacante redirecione a mídia da vítima, como áudio, para um host controlado pelo atacante. A injeção de RTP (RTP inject) permite que atacantes insiram pacotes RTP arbitrários em chamadas ativas.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. A malformed SIP message containing a large `Content-Length` value and a specially crafted Request-URI causes a segmentation fault in OpenSIPS. This issue occurs when a large amount of shared memory using the `-m` flag was allocated to OpenSIPS. The only workaround is to guarantee that the `Content-Length` value of input messages is never larger than `2147483647`.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. The issue is located in `msg translator.c:2628` and might lead to a server crash. This issue was found while fuzzing the function `build res buf from sip req` but could not be reproduced against a running instance of OpenSIPS. It is highly unlikely that this issue would lead to anything other than Denial of Service, even in the case of exploitation through unknown vectors.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. The issue arises when a malformed SDP body is received and processed by the `delete sdp line` function in the sipmsgops module. This can be reproduced by calling the function with an SDP body that does not terminate with a line feed (i.e., ` `). The vulnerability was discovered through black-box fuzzing and coverage-guided fuzzing on the `codec delete except re` function. The crash occurs because the `delete sdp line` function expects an SDP line to be terminated by a line feed (` `). An attacker can exploit this to crash the server, affecting configurations that rely on the affected code, such as the `codec delete except re` function. Exploitation results in a Denial of Service due to an `abort` in the lumps processing function.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. The issue arises when a malformed SDP body is received and processed by the `delete sdp line` function in the sipmsgops module. This can be reproduced by calling the function with an SDP body that does not terminate with a line feed (i.e., ` `). The vulnerability was discovered through black-box fuzzing and coverage-guided fuzzing on the `codec delete except re` function. The crash occurs because the `delete sdp line` function expects an SDP line to be terminated by a line feed (` `). An attacker can exploit this to crash the server, affecting configurations that rely on the affected code, such as the `codec delete except re` function. Exploitation results in a Denial of Service due to an `abort` in the lumps processing function.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. When the function `append hf` handles a SIP message with a malformed To header, a call to the function `abort()` is performed, resulting in a crash. This is due to the check in `data lump.c:399` in the function `anchor lump`. An attacker abusing this issue will crash OpenSIPS leading to Denial of Service. It affects configurations containing functions that make use of the affected code, such as the function `append hf`.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Sending a malformed `Via` header to OpenSIPS triggers a segmentation fault when the function `calc tag suffix` is called. A specially crafted `Via` header, which is deemed correct by the parser, will pass uninitialized strings to the function `MD5StringArray` which leads to the crash. Abuse of this issue leads to Denial of Service due to a crash. Since the uninitialized string points to memory location `0x0`, no further exploitation appears to be possible. No special network privileges are required to perform this attack, as long as the OpenSIPS configuration makes use of functions such as `sl send reply` or `sl gen totag` that trigger the vulnerable code.

A vulnerabilidade permite que um invasor realize um ataque de vazamento de hash SIP contra o FreeSWITCH, podendo recuperar senhas de gateways ao explorar o mecanismo de desafio-resposta de um gateway configurado no servidor FreeSWITCH. Isso é feito desafiando as solicitações SIP do FreeSWITCH com o domínio definido como o do gateway, forçando o FreeSWITCH a responder com a resposta de desafio baseada na senha do gateway visado. O invasor não precisa de privilégios especiais de rede para explorar essa vulnerabilidade, mas sim da capacidade de fazer com que o servidor da vítima envie mensagens de solicitação SIP para a parte maliciosa e especifique o domínio correto, que pode ser considerado secreto, mas pode ser facilmente recuperado, já que muitos gateways são públicos. A vulnerabilidade parece ser causada pelo código que lida com desafios em `sofia reg.c`, `sofia reg handle sip r challenge()`, que não verifica se o desafio se origina do gateway real, permitindo que UACs e gateways arbitrários desafiem qualquer solicitação enviada pelo FreeSWITCH com o domínio do gateway alvo.

O problema diz respeito à falta de autenticação para solicitações SIP do tipo SUBSCRIBE no FreeSWITCH. Isso permite que invasores se inscrevam para receber notificações de eventos de agentes de usuário sem autenticação, o que levanta preocupações com a privacidade e pode levar a ataques de engenharia social. Por exemplo, invasores podem ser capazes de monitorar o status de ramais SIP alvo. As mensagens SIP SUBSCRIBE devem ser autenticadas por padrão, e os administradores do FreeSWITCH não deveriam precisar definir explicitamente o parâmetro `auth-subscriptions`.

Foi detectada uma falha no módulo res pjsip session. Ao receber um novo SIP Invite, o Asterisk não retornou o diálogo criado bloqueado ou referenciado, causando uma lacuna entre a criação do objeto de diálogo e seu próximo uso. Essa lacuna permitia que outra thread liberasse o diálogo, levando a uma falha quando o objeto de diálogo ou seus objetos dependentes eram acessados. A falha só pode ocorrer ao usar um protocolo orientado a conexão (por exemplo, TCP ou TLS) para transporte SIP e quando o cliente remoto está autenticado ou o Asterisk está configurado para chamadas anônimas.

A implementação SIP fornece credenciais com hash em resposta a um desafio de autenticação inválido, facilitando que invasores remotos obtenham acesso por meio de um ataque de força bruta, relacionado a uma falha de “vazamento de SIP Digest”.

A implementação SIP fornece credenciais com hash em resposta a um desafio de autenticação inválido, facilitando que invasores remotos obtenham acesso por meio de um ataque de força bruta, relacionado a uma falha de “vazamento de hash SIP”.

A vulnerabilidade permite que invasores remotos obtenham acesso por meio de um ataque de força bruta devido ao envio de credenciais com hash em resposta a um desafio de autenticação inválido, relacionado a uma falha de “vazamento de SIP Digest”.

A Buffer Overflow issue was discovered. A specially crafted REGISTER message with a malformed branch or From tag triggers an off-by-one heap-based buffer overflow in the `tmx check pretran` function.

A Buffer Overflow issue was discovered in the processing of a SUBSCRIBE request by the res pjsip pubsub module. The module stores accepted formats from the Accept headers of the request but does not limit the number of headers it processes, despite a fixed limit of 32. If more than 32 Accept headers are present, the code writes outside of its memory, causing a crash.

An issue allows remote authenticated users to crash Asterisk by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection, resulting in a segmentation fault.

The issue allows unauthorized data disclosure, specifically media takeover in the RTP stack, with careful timing by an attacker. The "strictrtp" option in rtp.conf, enabled by default in Asterisk 11 and above, learns the source address of media for a session and drops any packets that do not originate from the expected address. However, when combined with symmetric RTP support, enabled through the "nat" and "rtp symmetric" options, a change in the strict RTP support introduced an avenue for media hijacking. This occurs when a flood of RTP traffic is received, allowing a new source address to be learned and used for outgoing traffic, thus hijacking the media.

The issue allows remote attackers to obtain sensitive information or cause a denial of service via crafted RTP packets, due to a NAT feature not properly determining the IP address and port number of the legitimate recipient of RTP traffic.

The issue allows remote attackers to cause a denial of service, resulting in an out-of-bounds read and application crash, via a crafted packet. This is due to a problem in the multi-part body parser in PJSIP.

A memory exhaustion issue exists, which can be triggered by sending specially crafted SCCP packets, causing an infinite loop and leading to memory exhaustion due to message logging in that loop.