OpenSIPS vulnerabilities

OpenSIPS prior to versions 3.6.6 and 4.0.0-rc1 contains a buffer overflow in the construct_uri() function, which concatenates URI components into a fixed 1024-byte buffer without bounds checking. An attacker can control the username to overflow the buffer and overwrite adjacent global data, including the disable_503_translation flag, altering routing behavior.

OpenSIPS versions 3.4.0-beta through 3.6.5 and 4.0.0-beta contain a buffer overflow in the {s.b64encode} string transformation. The size check does not account for base64 expansion, allowing overflow of up to 21,844 bytes, overwriting adjacent transformation buffers.

OpenSIPS version 4.0.0 and prior contain a stack buffer overflow in sip_to_json() when a SIP header name exceeds 255 bytes. An attacker can send a single UDP packet to port 5060 to crash the process or potentially achieve remote code execution.

In OpenSIPS up to 3.6.8/4.0.1, the rtpproxy_offer/rtpproxy_answer function of the rtpproxy component causes an out-of-bounds read. The attack may be initiated remotely. Upgrading to version 3.6.9 or 4.0.2 resolves the issue.

OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A malformed SDP bandwidth line can corrupt parsed metadata, leading to a crash of the OpenSIPS worker process.

OpenSIPS versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. A SUBSCRIBE request with a long From URI can cause a stack buffer overflow and crash the process.

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bounds read via strncmp() when searching for MIME boundary delimiters. After finding a -- pattern near the end of the body, the function compares delimiter.len bytes (typically 20-70) starting from a position at or past the logical end of the body buffer, reading past the body boundary. The bug triggers when a SIP message has Content-Type: multipart/mixed with a boundary parameter and its body contains -- within two to three bytes of the body's end without being followed by the actual boundary delimiter. This issue has been fixed in versions 3.6.6 and 4.0.0-rc1.

In OpenSIPS prior to versions 3.6.6 and 4.0.0-rc1, the TCP message framing layer parses the Content-Length header using unsigned int arithmetic with no overflow check. An attacker can send a Content-Length value that overflows (e.g., 4294967296), causing the framing layer to compute a wrapped-around value and split the TCP stream at the wrong boundary, enabling SIP message smuggling. Because Content-Length is parsed before authentication, an unauthenticated attacker can smuggle arbitrary SIP messages over any TCP-based transport.

In OpenSIPS versions 3.4.0 through 3.6.5, there is a denial of service vulnerability in the presence module. The handle_publish() function processes a SIP PUBLISH request with an Event: presence header and a message body while enable_sphere_check=1, invoking get_content_type() without first calling parse_content_type_hdr(), causing a crash due to dereferencing uninitialized or NULL Content-Type parsing state. A remote attacker can cause a denial of service with a single PUBLISH request over UDP or TCP.

The auth_jwt module in OpenSIPS versions 3.1 before 3.6.4 contains a SQL injection vulnerability in the jwt_db_authorize() function. An attacker can send a crafted JWT with a malicious tag claim that is directly incorporated into a SQL query without sanitization, allowing bypass of JWT authentication and impersonation of arbitrary identities.