Kamailio vulnerabilities

A stack-based buffer overflow exists in the ims_qos_npn module of Kamailio v6.1.3 and v6.1.4. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.

A stack-based buffer overflow exists in the ims_registrar_pcscf module of Kamailio v6.1.3 and v6.1.4. When processing a crafted application/reginfo+xml NOTIFY message, process_contact() copies an attacker-controlled port value from the alias parameter into a fixed 5-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger stack corruption and terminate the P-CSCF process, resulting in denial of service.

The kamcmd administrative utility and default configuration in kamailio before version 4.3.0 use the /tmp/kamailio_ctl directory.

Versions of kamailio before 4.2.0-2 have a vulnerability that allows local users to gain elevated privileges.

CVE-2013-7426 identifies an insecure handling of temporary files in kamailio 4.0.1, specifically concerning the /tmp/kamailio_fifo file. This may lead to unauthorized access to data.

A vulnerability was detected in Kamailio up to versions 6.0.7/6.1.3 in the isup_get_calling_party function of the file src/modules/sipt/ss7_parser.c in the sipt module. Manipulation of the length argument results in buffer overflow. The attack may be performed remotely.

A weakness in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1 affects the shm_malloc function in src/modules/cdp/receiver.c of the CDP Diameter Receiver component. Manipulation leads to a heap-based buffer overflow. The attack can be remote, and the exploit is public. Upgrading to 6.0.8 resolves the issue.

An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifically the pcscf_save_pending/save_pending path and security-agreement parsing in sec_agree.c:parse_sec_agree().

A vulnerability in Kamailio version 6.1.1 and earlier allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling components.

A vulnerability in Kamailio up to 5.5.0/6.0.7 in the get_4bytes function of the cxdx_avp.c file in the AVP Handler component leads to an out-of-bounds read. The attack can be performed remotely, and the exploit is publicly disclosed.

Kamailio before versions 6.0.5 and 5.8.7 contains an out-of-bounds read vulnerability in the auth module. A specially crafted SIP packet can cause a process crash (DoS) after successful user authentication without a database backend.

In Kamailio (formerly OpenSER and SER) prior to versions 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access vulnerability exists in the core. A remote attacker can send a specially crafted TCP packet, causing a process crash (denial of service). This affects Kamailio instances with TCP or TLS listeners.

In Kamailio 5.5, the yyerror_at function in src/core/cfg.y (grammar rule handler) causes a null pointer dereference. The attack requires local access and manipulation of configuration files. The vulnerability's existence is questioned, and the vendor did not respond.

A flaw in Kamailio 5.5 in the rve_is_constant function of src/core/rvalue.c causes a null pointer dereference. The attack requires local access and manipulation of configuration files. The vulnerability's existence is still questioned, and the vendor did not respond to the disclosure.

A vulnerability was detected in Kamailio 5.5 in the function sr_push_yy_state of the file src/core/cfg.lex (Configuration File Handler component). The manipulation results in use after free. The attack must be initiated from a local position and requires manipulating config files.

A vulnerability was detected in Kamailio 5.5 in the rve_destroy function of src/core/rvalue.c (configuration file handler). Manipulation leads to a heap-based buffer overflow. The attack requires local access and config file manipulation, and the exploit is publicly disclosed. There is ongoing doubt about the real existence of this vulnerability.