Kamailio ims_registrar_pcscf buffer overflow lets attackers stop P-CSCF
A phone call connection server can be stopped by one packet!
Summary
The ims_registrar_pcscf module in Kamailio copies the port field of reginfo NOTIFY messages into a 5-byte stack buffer without a length check. An unauthenticated remote attacker can crash the P-CSCF process with one UDP packet; Kamailio 6.1.3 and 6.1.4 are affected.
Affected when
- ims_registrar_pcscf module in use
- subscribe_to_reginfo = 1 setting
What to do
No fixed version is named yet. Check whether you run Kamailio 6.1.3 or 6.1.4, and follow the update news in issue #4954.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
Times
First published
First seen