Buffer Overflow Vulnerability in PJSIP DNS Resolver - CVE-2023-27585
Summary
ALPINE-CVE-2023-27585: PJSIP is a free and open source multimedia communication library written in C. Affects pjproject versions < 2.13.1-r0. Fixed in 2.13.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PJSIP is a free and open-source multimedia communication library written in C, widely used for building applications that require audio, video, presence, and instant messaging. It provides a robust framework for handling multimedia communications over IP networks. However, versions 2.13 and prior have a critical vulnerability related to the DNS resolver, which can lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability, identified as CVE-2023-27585, is a buffer overflow issue in the PJSIP DNS resolver that affects applications utilizing this feature. It arises from improper handling of DNS query records in the parse_query() function, which can lead to memory corruption and potential application crashes. This vulnerability is particularly concerning as it can be exploited by attackers to execute arbitrary code or cause denial of service, impacting the integrity and availability of affected applications.
How To Fix
Minimum fixed version
2.13.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade pjprojectTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can disable DNS resolution in the PJSIP configuration by setting the nameserver_count to zero. This can be done in your PJSIP configuration file as follows:
{
"nameserver_count": 0
}
Conclusion
CVE-2023-27585 presents a significant risk to applications using the PJSIP DNS resolver. It is crucial to update to the patched version to mitigate this vulnerability. Additionally, utilizing workarounds can provide temporary relief while ensuring that your applications remain secure.
See every vulnerability recorded for pjproject →
FAQ
CVE-2023-27585 is a buffer overflow vulnerability in the PJSIP DNS resolver that affects versions 2.13 and prior.
If your application uses the PJSIP DNS resolver, it may be susceptible to memory corruption, which can lead to crashes or arbitrary code execution.
You can disable DNS resolution in your PJSIP configuration as a temporary workaround until you can apply the update.
Yes, a patch is available in version 2.13.1-r0 and later of the PJSIP package.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just a manifest file like package-lock.json. You can check your application for vulnerabilities without signing up at the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for pjproject.
