摘要:
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind ` 0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
安全等级: Low
公告ID: KylinSec-SA-2022-2532
发布日期: 2022年10月24日
关联CVE: CVE-2022-31003
Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = record + 2` will access the memory behind ` 0` and cause an out-of-bounds write. An attacker can send a message with evil sdp to FreeSWITCH, causing a crash or more serious consequence, such as remote code execution. Version 1.13.8 contains a patch for this issue.
| cve名称 | 产品 | 组件 | 是否受影响 |
|---|---|---|---|
| CVE-2022-31003 | KY3.4-4A | sofia-sip | Unaffected |
| CVE-2022-31003 | KY3.4-5 | sofia-sip | Unaffected |
| CVE-2022-31003 | KY3.5.1 | sofia-sip | Unaffected |
