Description
Sofia-SIP through 1.13.18 contains a heap out-of-bounds read vulnerability in msg_multipart_parse() that allows unauthenticated remote attackers to crash the process by sending oversized MIME boundaries. Attackers can send an INVITE with a multipart Content-Type whose boundary exceeds the body length, causing memcmp to read past the heap buffer and crash the process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
freeswitch sofia-sip
Default version status: unaffected
0 to ≤ 1.13.18affected
pkg:github/freeswitch/sofia-sipReferences
- https://hackmd.io/@haind-pwn/sofia-sip-multipart-oob-read ↗
- https://github.com/freeswitch/sofia-sip/blob/ad36ac8f755308e8b87f98a505e83d4e408e5cc3/libsofia-sip-ua/msg/msg_mime.c#L404 ↗
- https://github.com/freeswitch/sofia-sip ↗
- https://www.vulncheck.com/advisories/sofia-sip-through-1.13.18-heap-out-of-bounds-read-via-msg-multipart-parse ↗