« Volver al listado

CVE-2023-27600

Estado: ModificadaAlta (7.5)—

OpenSIPS es una implementación de servidor del protocolo de inicio de sesión (SIP, Session Initiation Protocol). Antes de las versiones 3.1.7 y 3.2.4, OpenSIPS se bloquea cuando recibe un cuerpo SDP malformado y lo procesa la función `delete_sdp_line` del módulo sipmsgops. Este problema puede reproducirse llamando a la función con un cuerpo SDP que no termina con un salto de línea (es decir, ` `).

La vulnerabilidad se detectó mientras se realizaban pruebas de fuzzing de caja negra contra un servidor OpenSIPS que ejecutaba una configuración que utilizaba las funciones `codec_delete_except_re` y `codec_delete_re`.

Leer descripción completaMostrar menos

El mismo problema también se descubrió mientras se realizaba fuzzing guiado por cobertura sobre la función `codec_delete_except_re`. El fallo se produce porque la función `delete_sdp_line` espera que una línea SDP termine con un salto de línea (` `).

Aprovechando esta vulnerabilidad, un atacante puede provocar que el servidor se bloquee. Afecta a configuraciones que contienen funciones que dependen del código afectado, como la función `codec_delete_except_re`. Debido a la comprobación de coherencia que se realiza en la función `del_lump`, la explotación de este problema generará un `abort` en la función de procesamiento de lumps, lo que provoca una denegación de servicio. Este problema está corregido en las versiones 3.1.7 y 3.2.4.

Traducción automática del texto original de NVD (en inglés).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Opensips — Opensips

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-27600",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-27600",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-25T14:30:49.802058Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "OpenSIPS",
          "product": "opensips",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.1.7"
            },
            {
              "status": "affected",
              "version": ">= 3.2.0, < 3.2.4"
            }
          ]
        }
      ]
    }
  ],
  "published": "2023-03-15T22:15:10.267",
  "references": [
    {
      "url": "https://github.com/OpenSIPS/opensips/commit/c6ab3bb406c447e30c7d33a1a8970048b4612100",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://opensips.org/docs/modules/3.3.x/sipmsgops.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/OpenSIPS/opensips/commit/c6ab3bb406c447e30c7d33a1a8970048b4612100",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/OpenSIPS/opensips/security/advisories/GHSA-67w7-g4j8-3wcx",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://opensips.org/docs/modules/3.3.x/sipmsgops.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://opensips.org/pub/audit-2022/opensips-audit-technical-report-full.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Prior to versions 3.1.7 and 3.2.4, OpenSIPS crashes when a malformed SDP body is received and is processed by the `delete_sdp_line` function in the sipmsgops module. This issue can be reproduced by calling the function with an SDP body that does not terminate by a line feed (i.e. `\\n`).\n\nThe vulnerability was found while performing black-box fuzzing against an OpenSIPS server running a configuration that made use of the functions `codec_delete_except_re` and `codec_delete_re`. The same issue was also discovered while performing coverage guided fuzzing on the function `codec_delete_except_re`. The crash happens because the function `delete_sdp_line` expects that an SDP line is terminated by a line feed (`\\n`).\n\nBy abusing this vulnerability, an attacker is able to crash the server. It affects configurations containing functions that rely on the affected code, such as the function `codec_delete_except_re`. Due to the sanity check that is performed in the `del_lump` function, exploitation of this issue will generate an `abort` in the lumps processing function, resulting in a Denial of Service. This issue is patched in versions 3.1.7 and 3.2.4."
    }
  ],
  "lastModified": "2026-06-17T05:45:33.583",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EF642AA-D786-40DF-801D-515888AF89BE",
              "versionEndExcluding": "3.1.7"
            },
            {
              "criteria": "cpe:2.3:a:opensips:opensips:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34713A76-CAED-43CF-A77C-73F1C36208AA",
              "versionEndExcluding": "3.2.4",
              "versionStartIncluding": "3.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}