Kamailio ims_qos_npn buffer overflow lets attackers crash the server
A voice call server (Kamailio) can be stopped by one request.
Summary
The ims_qos_npn module in Kamailio copies the Via host value from a SIP REGISTER request into a 46-byte buffer without checking its length. One unauthenticated request can terminate the Kamailio process.
Affected when
- ims_qos_npn module loaded
- Rx interface enabled
What to do
If you run Kamailio 6.1.3 or 6.1.4 (or the master branch), check that you run a newer version and read the vendor's advisory. No source names a fixed version.
Products and platforms
CVE IDs
Sources
- Write-up: github.com (opens in a new tab)
Times
First published
First seen