Segmentation Fault Vulnerability in Kamailio Package Leading to Potential Denial of Service
Summary
DEBIAN-CVE-2018-14767: In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag causes a segmentation fault and crash. Affects kamailio versions < 5.1.4-1. Fixed in 5.1.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kamailio is an open-source SIP (Session Initiation Protocol) server that is widely used for handling voice over IP (VoIP) communications. It is known for its flexibility, scalability, and ability to manage thousands of calls per second. However, like many software packages, it is susceptible to vulnerabilities that can compromise its stability and security. This specific vulnerability affects versions prior to 5.0.7 and 5.1.x before 5.1.4, where improper input validation can lead to a crash.
Vulnerability Detail
In Kamailio versions before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message containing a double 'To' header and an empty 'To' tag can trigger a segmentation fault in the 'build_res_buf_from_sip_req' core function. This vulnerability arises from a lack of input validation, which can result in a denial of service (DoS) condition and potentially allow for arbitrary code execution, posing significant risks to the server's integrity and availability.
How To Fix
Minimum fixed version
5.1.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kamailioTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can filter incoming SIP messages to prevent those with double 'To' headers and empty 'To' tags from reaching the Kamailio server. This can be done by implementing custom rules in the SIP message handling configuration.
Conclusion
The Kamailio vulnerability identified as CVE-2018-14767 poses significant risks due to improper input validation, leading to potential server crashes and arbitrary code execution. Users are advised to update to the patched version 5.1.4-1 to ensure their systems remain secure.
See every vulnerability recorded for kamailio →
FAQ
Kamailio is an open-source SIP server used for managing VoIP communications, known for its high performance and flexibility.
The vulnerability allows a specially crafted SIP message to crash the Kamailio server, potentially leading to denial of service.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The risks include server crashes and potential arbitrary code execution, which can compromise the security and availability of the VoIP service.
It is recommended to regularly check for updates and apply them promptly to mitigate vulnerabilities and enhance security.
References
Related vulnerabilities
Recent vulnerabilities recorded for kamailio.
