Buffer Overflow Vulnerability in Kamailio SIP Server - CVE-2020-27507
Summary
CVE-2020-27507: The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that crashes the server or possibly have unspecified other impact. Affects kamailio across 2 version ranges.
< 5.4.2-1
< ada3701d22b1fd579f06b4f54fa695fa988e685f
Fixed in 5.4.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kamailio is an open-source SIP (Session Initiation Protocol) server that is widely used for handling VoIP (Voice over Internet Protocol) communications. It is known for its flexibility, scalability, and ability to manage thousands of calls. The server is designed to facilitate the setup, management, and teardown of communication sessions. However, prior to version 5.5.0, Kamailio is vulnerable to a buffer overflow issue when processing INVITE requests that contain duplicated fields and overlength tags.
Vulnerability Detail
The vulnerability identified as CVE-2020-27507 arises from the Kamailio SIP server's mishandling of INVITE requests that include duplicated fields and excessively long tags. This flaw can lead to a buffer overflow, which may cause the server to crash or potentially allow for other unspecified impacts. The issue is rooted in the way the server processes incoming SIP messages, making it susceptible to malformed requests that exploit this weakness.
How To Fix
Minimum fixed version
5.4.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kamailioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement input validation to filter out malformed SIP requests. This can help reduce the risk of exploitation until an upgrade can be performed. However, this is not a complete solution and should only be used as a stopgap.
Conclusion
CVE-2020-27507 represents a critical vulnerability in the Kamailio SIP server that can lead to server crashes and potential exploitation. It is crucial for users to upgrade to version 5.5.0 or later to mitigate this risk. Temporary workarounds can be employed, but they do not replace the need for an upgrade.
See every vulnerability recorded for kamailio →
FAQ
CVE-2020-27507 is a vulnerability in the Kamailio SIP server that can lead to a buffer overflow due to mishandling of certain SIP INVITE requests.
The CVSS score for this vulnerability is 9.8, indicating a critical level of severity that could lead to significant impacts on the server's functionality.
Kamailio versions prior to 5.5.0 are affected by this vulnerability. Users are advised to upgrade to the latest version to ensure security.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, consider implementing input validation to filter out malformed SIP requests as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for kamailio.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.