Privilege Escalation Vulnerability in Kamailio Package
Summary
DEBIAN-CVE-2015-1591: The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. Affects kamailio versions < 4.2.0-2. Fixed in 4.2.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Kamailio is an open-source SIP server that provides a robust platform for handling voice over IP (VoIP) communications. It is widely used for building scalable and flexible telephony applications. The package is known for its high performance and ability to handle thousands of calls simultaneously. However, certain versions of Kamailio prior to 4.2.0-2 are vulnerable to a privilege escalation issue that could allow local users to gain unauthorized access to elevated privileges.
Vulnerability Detail
The vulnerability identified as DEBIAN-CVE-2015-1591 allows local users to exploit the Kamailio build before version 4.2.0-2. This flaw can lead to unauthorized privilege escalation, enabling attackers to execute commands with higher privileges than intended. The vulnerability arises from improper handling of user permissions within the Kamailio process, which can be exploited by malicious users on the same system.
How To Fix
Minimum fixed version
4.2.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kamailioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, system administrators can restrict access to the Kamailio process for non-privileged users, thereby reducing the risk of exploitation until the package can be updated. This can be achieved by modifying file permissions or using access control lists (ACLs) to limit user access.
Conclusion
The privilege escalation vulnerability in the Kamailio package poses a significant risk to systems running affected versions. It is crucial for users to update to version 4.2.0-2 or later to mitigate this risk. Additionally, employing temporary workarounds can help secure systems until updates are applied.
See every vulnerability recorded for kamailio →
FAQ
The vulnerability allows local users to escalate their privileges, potentially leading to unauthorized access and control over the system.
Versions of Kamailio prior to 4.2.0-2 are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected by this vulnerability.
As a temporary measure, restrict access to the Kamailio process for non-privileged users to minimize the risk of exploitation.
Yes, Vulert provides a service that can monitor your application for vulnerabilities in real-time using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for kamailio.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.