OpenSIPS presence module NULL pointer dereference DoS vulnerability analysis

Vulnerability Overview A denial-of-service (DoS) vulnerability exists in the module of OpenSIPS. When the function processes a SIP PUBLISH request containing an header, a message body, and the configuration option , OpenSIPS crashes due to a NULL pointer dereference if the parsing state is uninitialized. Testing confirms that both requests with and requests lacking a header cause a crash. This vulnerability can be triggered under both UDP and TCP protocols. Impact Scope Affected Versions: 3.4, 3.6, 4.0 Fixed Versions: 4.0 Severity: High (CVSS Score 8.7/10) Attack Vector: Network Attack Complexity: Low Required Privileges: None User Interaction: None Confidentiality Impact: None Integrity Impact: None Availability Impact: High Remediation OpenSIPS has released a patch to fix this vulnerability. It is recommended that users upgrade to the fixed versions of OpenSIPS 3.6.6, 4.0.0, or higher. If immediate upgrading is not possible, access to the affected module should be restricted, or the module should be disabled until the patch is applied. POC Code Below is a UDP payload used to reproduce the crash (replace with the target IP address): Technical Details The function contains the following code: The function is defined as a macro: In this execution path, reaches before calling . If a header is present but not parsed, is , and the macro dereferences it as a pointer. If the request completely lacks a header, is , and the macro again dereferences a NULL pointer. Both scenarios result in a crash. Reproduction Steps Run an OpenSIPS instance with the following configuration: Execute the aforementioned UDP payload to reproduce the crash (replace with the target IP address). ASan Results For the case where the header is missing, ASan reports a related with a NULL pointer dereference at within . Solutions and Recommendations OpenSIPS has released a patch to fix this vulnerability. It is recommended that users upgrade to the fixed versions of OpenSIPS 3.6.6, 4.0.0, or higher. If immediate upgrading is not possible, access to the affected module should be restricted, or the module should be disabled until the patch is applied. About Enable Security Enable Security provides penetration testing services to help protect your real-time communication systems from attacks. Disclaimer The information contained in this advisory is based on currently available data and is considered accurate at the time of publication. Use of this information implies acceptance of its "AS IS" status. No express or implied warranties are made regarding this information. The authors or publishers shall not be liable for any direct, indirect, consequential, or incidental damages arising from the use or reliance on this information. Disclosure Policy This report is subject to the Enable Security Vulnerability Disclosure Policy, available at https://github.com/EnableSecurity/Vulnerability-Disclosure-Policy.

Goal Reached Thanks to every supporter — we hit 100%!

OpenSIPS presence module NULL pointer dereference DoS vulnerability analysis

More from this source