In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.

osip developers reports :

In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.

Multiple security vulnerabilities have been found in oSIP, a library implementing the Session Initiation Protocol, which might result in denial of service through malformed SIP messages.

This update for libosip2 fixes several issues. These security issues were fixed :

  - CVE-2017-7853: In libosip2 a malformed SIP message could     have lead to a heap buffer overflow in the     msg_osip_body_parse() function defined in     osipparser2/osip_message_parse.c, resulting in a remote     DoS (bsc#1034570).

  - CVE-2016-10326: In libosip2 a malformed SIP message     could have lead to a heap buffer overflow in the     osip_body_to_str() function defined in     osipparser2/osip_body.c, resulting in a remote DoS     (bsc#1034571).

  - CVE-2016-10325: In libosip2 a malformed SIP message     could have lead to a heap buffer overflow in the
    _osip_message_to_str() function defined in     osipparser2/osip_message_to_str.c, resulting in a remote     DoS (bsc#1034572).

  - CVE-2016-10324: In libosip2 a malformed SIP message     could have lead to a heap buffer overflow in the     osip_clrncpy() function defined in     osipparser2/osip_port.c (bsc#1034574).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libosip2 fixes the following issues :

Changes in libosip2 :

  - CVE-2017-7853: In libosip2 in GNU 5.0.0, a malformed SIP     message can lead to a heap buffer overflow in the     msg_osip_body_parse() function defined in     osipparser2/osip_message_parse.c, resulting in a remote     DoS. (boo#1034570)

  - CVE-2016-10326: In libosip2 in GNU oSIP 4.1.0, a     malformed SIP message can lead to a heap buffer overflow     in the osip_body_to_str() function defined in     osipparser2/osip_body.c, resulting in a remote DoS.
    (boo#1034571)

  - CVE-2016-10325: In libosip2 in GNU oSIP 4.1.0, a     malformed SIP message can lead to a heap buffer overflow     in the _osip_message_to_str() function defined in     osipparser2/osip_message_to_str.c, resulting in a remote     DoS. (boo#1034572)

  - CVE-2016-10324: In libosip2 in GNU oSIP 4.1.0, a     malformed SIP message can lead to a heap buffer overflow     in the osip_clrncpy() function defined in     osipparser2/osip_port.c. (boo#1034574)

CVE-2016-10324 In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_clrncpy() function defined in osipparser2/osip_port.c.

CVE-2016-10325 In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the _osip_message_to_str() function defined in osipparser2/osip_message_to_str.c, resulting in a remote DoS.

CVE-2016-10326 In libosip2 in GNU oSIP 4.1.0, a malformed SIP message can lead to a heap buffer overflow in the osip_body_to_str() function defined in osipparser2/osip_body.c, resulting in a remote DoS.

CVE-2017-7853 In libosip2 in GNU oSIP 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function defined in osipparser2/osip_message_parse.c, resulting in a remote DoS.

For Debian 7 'Wheezy', these problems have been fixed in version 3.6.0-4+deb7u1.

We recommend that you upgrade your libosip2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
103795	FreeBSD : osip -- Improper Restriction of Operations within the Bounds of a Memory Buffer (15a62f22-098a-443b-94e2-2d26c375b993)	Nessus	FreeBSD Local Security Checks	high
100773	Debian DSA-3879-1 : libosip2 - security update	Nessus	Debian Local Security Checks	critical
100024	SUSE SLED12 Security Update : libosip2 (SUSE-SU-2017:1187-1)	Nessus	SuSE Local Security Checks	critical
99752	openSUSE Security Update : libosip2 (openSUSE-2017-526)	Nessus	SuSE Local Security Checks	critical
99403	Debian DLA-898-1 : libosip2 security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2017-7853

high

Tenable Plugins

high

critical

critical

critical

critical