Description
SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
SIPp sipp
Default version status: unaffected
0 to ≤ 3.7.7affected
References
- https://github.com/SIPp/sipp/pull/880 ↗
- https://github.com/SIPp/sipp/commit/1d4a5622bea34d0b5cdff333e6b5734608e30af7 ↗
- https://github.com/SIPp/sipp/blob/v3.7.7/src/auth.cpp#L183-L192 ↗
- https://github.com/SIPp/sipp ↗
- https://www.vulncheck.com/advisories/sipp-through-3.7.7-stack-buffer-overflow-via-createauthheader-algorithm-parameter ↗