Kamailio Header-Removal Bypass Vulnerability in Sippy Softswitch
Summary
CVE-2020-28361: Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allows a bypass of a header-removal protection mechanism via whitespace characters. Affects kamailio across 2 version ranges.
< 5.4.0-1
< 6c4fceb2ab6818678df16fa3df554392b0707572
Fixed in 5.4.0-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kamailio is an open-source SIP server that facilitates voice over IP (VoIP) communications. It is widely used in various applications, including Sippy Softswitch, which is a platform for managing VoIP services. The affected versions of Kamailio prior to 5.4.0 contain a vulnerability that allows attackers to bypass header-removal protections, potentially leading to significant disruptions in call accounting mechanisms.
Vulnerability Detail
The vulnerability, identified as CVE-2020-28361, originates from the remove_hf function in the Kamailio textops module. It allows skilled attackers with valid credentials to exploit whitespace characters to bypass header-removal protections. This can disrupt internal call start and duration accounting mechanisms, leading to potential revenue loss for service providers. The vulnerability affects multiple Debian ecosystems and can be exploited in various products utilizing Kamailio.
How To Fix
Minimum fixed version
5.4.0-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kamailioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional monitoring on their SIP traffic to detect unusual patterns that may indicate exploitation attempts. However, this is not a substitute for upgrading the software.
Conclusion
CVE-2020-28361 represents a significant vulnerability in Kamailio that can lead to serious disruptions in VoIP services. Users are strongly advised to upgrade to the latest version to mitigate the risks associated with this vulnerability. Regular monitoring and prompt updates are essential for maintaining the security of VoIP applications.
See every vulnerability recorded for kamailio →
FAQ
CVE-2020-28361 is a vulnerability in Kamailio that allows attackers to bypass header-removal protections using whitespace characters.
Exploitation of this vulnerability can disrupt call accounting mechanisms, potentially leading to revenue loss for service providers.
Kamailio versions prior to 5.4.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for CVE-2020-28361 is 5.4, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for kamailio.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.