CVE-2018-16657

EUVD-2018-8459

07.09.2018, 14:29

In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation fault and crashes Kamailio. The reason is missing input validation in the crcitt_string_array core function for calculating a CRC hash for To tags. (An additional error is present in the check_via_address core function: this function also misses input validation.) This could result in denial of service and potentially the execution of arbitrary code.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	9.8 CRITICAL	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 50%

Affected Products (NVD)

Vendor	Product	Version
debian	debian_linux	8.0
debian	debian_linux	9.0
kamailio	kamailio	𝑥 < 5.0.7
kamailio	kamailio	5.1.0 ≤ 𝑥 < 5.1.4

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

kamailio

bookworm	5.6.3-2 fixed
bullseye	5.4.4-1 fixed
sid	5.8.3-1 fixed
trixie	5.8.3-1 fixed

Ubuntu Releases

Ubuntu Product

Codename

kamailio

bionic	Fixed 5.1.2-1ubuntu2+esm1 released
cosmic	ignored
disco	not-affected
eoan	not-affected
focal	not-affected
groovy	not-affected
hirsute	not-affected
impish	not-affected
jammy	not-affected
kinetic	not-affected
lunar	not-affected
trusty	dne
xenial	Fixed 4.3.4-1.1ubuntu2.1+esm1 released

Known Exploits!

Common Weakness Enumeration

CWE-476 - NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

References

https://lists.debian.org/debian-lts-announce/2018/09/msg00013.html

https://skalatan.de/blog/advisory-hw-2018-06

https://www.debian.org/security/2018/dsa-4292

https://lists.debian.org/debian-lts-announce/2018/09/msg00013.html

https://skalatan.de/blog/advisory-hw-2018-06

https://www.debian.org/security/2018/dsa-4292