heap-over-flow and integer-overflow in stun_parse_attr_error_code and stun_parse_attr_uint32
Source: sofia-sip Version: 1.12.11+20110422.1+1e14eea~dfsg-5 Severity: grave Tags: security upstream Forwarded: https://github.com/freeswitch/sofia-sip/pull/214 X-Debbugs-Cc: car...@debian.org, Debian Security Team <t...@security.debian.org>
Hi, The following vulnerability was published for sofia-sip. CVE-2023-32307[0]: | Sofia-SIP is an open-source SIP User-Agent library, compliant with the | IETF RFC3261 specification. Referring to [GHSA-8599-x7rq- | fr54](https://github.com/freeswitch/sofia- | sip/security/advisories/GHSA-8599-x7rq-fr54), several other potential | heap-over-flow and integer-overflow in stun_parse_attr_error_code and | stun_parse_attr_uint32 were found because the lack of attributes | length check when Sofia-SIP handles STUN packets. The previous patch | of [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia- | sip/security/advisories/GHSA-8599-x7rq-fr54) fixed the vulnerability | when attr_type did not match the enum value, but there are also | vulnerabilities in the handling of other valid cases. The OOB read and | integer-overflow made by attacker may lead to crash, high consumption | of memory or even other more serious consequences. These issue have | been addressed in version 1.13.15. Users are advised to upgrade. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2023-32307 https://www.cve.org/CVERecord?id=CVE-2023-32307 [1] https://github.com/freeswitch/sofia-sip/pull/214 [2] https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-rm4c-ccvf-ff9c [3] https://github.com/freeswitch/sofia-sip/commit/c3bbc50c88d168065de34ca01b9b1d98c1b0e810 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
Read more here: Source link