In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag causes a segmentation fault and crash. The reason is missing input validation in the "build_res_buf_from_sip_req" core function. This could result in denial of service and potentially the execution of arbitrary code.
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Link | Tags |
---|---|
https://www.debian.org/security/2018/dsa-4267 | third party advisory vendor advisory |
https://lists.debian.org/debian-lts-announce/2018/08/msg00018.html | third party advisory mailing list |
https://skalatan.de/blog/advisory-hw-2018-05 | exploit third party advisory patch |