Sipp
Monthly
SIPp's get_header() parser function in versions through 3.7.7 is vulnerable to a classic CWE-120 stack buffer overflow triggered by SIP messages containing header content exceeding approximately 20,490 bytes. Any unauthenticated network peer reaching the SIPp listener can crash the process with a single crafted SIP packet; the CVSS 4.0 vector (VA:H, no C/I impact) and source code evidence confirm this is an availability-only impact with no confirmed code-execution path. The upstream fix (commit 8ddfb43, PR #881) replaces unbounded sprintf() calls with snprintf() bounds enforcement, but no official tagged release incorporating the fix has been confirmed at time of analysis.
Stack-based buffer overflow in SIPp through 3.7.7 allows a malicious SIP server to crash the client process by sending a crafted 401 or 407 authentication challenge containing an oversized algorithm parameter. The flaw originates in createAuthHeader() at src/auth.cpp:183-192, where the original code uses strncpy bounded by end-start (an attacker-controlled length derived from the algorithm field) rather than the fixed size of the stack-allocated algo buffer. No public exploit has been identified at time of analysis, but upstream fix code is publicly available via GitHub PR #880.
Stack buffer overflow in SIPp through 3.7.7 allows unauthenticated remote attackers to crash the process by sending a crafted SIP message whose To header tag parameter is 2049 bytes or longer. The get_peer_tag() function in sip_parser.cpp copies the tag value into a fixed-size static buffer without a bounds check, enabling the overflow and resulting in a process crash. No public exploit has been identified at time of analysis, but the trigger condition is trivial to reproduce given the precise byte threshold documented by VulnCheck, and an upstream fix has been committed.
SIPp 3.6 and earlier contains a local buffer overflow vulnerability in command-line argument handling that allows local attackers to crash the application or execute arbitrary code. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SIPP 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious input in the configuration file. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
SIPp's get_header() parser function in versions through 3.7.7 is vulnerable to a classic CWE-120 stack buffer overflow triggered by SIP messages containing header content exceeding approximately 20,490 bytes. Any unauthenticated network peer reaching the SIPp listener can crash the process with a single crafted SIP packet; the CVSS 4.0 vector (VA:H, no C/I impact) and source code evidence confirm this is an availability-only impact with no confirmed code-execution path. The upstream fix (commit 8ddfb43, PR #881) replaces unbounded sprintf() calls with snprintf() bounds enforcement, but no official tagged release incorporating the fix has been confirmed at time of analysis.
Stack-based buffer overflow in SIPp through 3.7.7 allows a malicious SIP server to crash the client process by sending a crafted 401 or 407 authentication challenge containing an oversized algorithm parameter. The flaw originates in createAuthHeader() at src/auth.cpp:183-192, where the original code uses strncpy bounded by end-start (an attacker-controlled length derived from the algorithm field) rather than the fixed size of the stack-allocated algo buffer. No public exploit has been identified at time of analysis, but upstream fix code is publicly available via GitHub PR #880.
Stack buffer overflow in SIPp through 3.7.7 allows unauthenticated remote attackers to crash the process by sending a crafted SIP message whose To header tag parameter is 2049 bytes or longer. The get_peer_tag() function in sip_parser.cpp copies the tag value into a fixed-size static buffer without a bounds check, enabling the overflow and resulting in a process crash. No public exploit has been identified at time of analysis, but the trigger condition is trivial to reproduce given the precise byte threshold documented by VulnCheck, and an upstream fix has been committed.
SIPp 3.6 and earlier contains a local buffer overflow vulnerability in command-line argument handling that allows local attackers to crash the application or execute arbitrary code. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SIPP 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious input in the configuration file. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available.