resiprocate - Denial of Service Vulnerability (CVE-2017-11521)
Summary
DLA-1040-1: resiprocate - security update. Affects resiprocate versions < 1.8.5-4+deb7u1. Fixed in 1.8.5-4+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
resiprocate is a package in the Debian 7 Wheezy ecosystem that provides a SIP (Session Initiation Protocol) stack implementation. It is used for building communication applications that rely on SIP for signaling. The package includes various components for handling SIP messages, media connections, and session management.
Vulnerability Detail
The SdpContents::Session::Medium::parse function in resip/stack/SdpContents.cxx in reSIProcate 1.10.2 is vulnerable to a denial of service (DoS) attack. This vulnerability can be exploited by remote attackers to consume excessive memory by triggering multiple media connections. By sending specially crafted SIP messages, an attacker can cause the application to allocate and retain large amounts of memory, leading to a DoS condition.
How To Fix
Minimum fixed version
1.8.5-4+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade resiprocateTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading the resiprocate package to the patched version.
Conclusion
The resiprocate package in Debian 7 Wheezy is vulnerable to a denial of service (DoS) attack. To mitigate this vulnerability, it is crucial to upgrade the package to version 1.8.5-4+deb7u1 or later. No known workarounds exist for this issue. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for resiprocate →
FAQ
This vulnerability allows remote attackers to cause a denial of service (DoS) condition by consuming excessive memory. It can lead to application crashes or unresponsiveness, affecting the availability of the affected system.
Yes, this vulnerability can be exploited remotely by sending specially crafted SIP messages to the affected application.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory.
No, there is no specific CVSS score provided for this vulnerability.
In most cases, it is not necessary to restart the application after applying the fix. However, it is recommended to follow any instructions provided during the package upgrade process.
Related vulnerabilities
Recent vulnerabilities recorded for resiprocate.
