Summary
Stelios Tsampas discovered that Kamailio did not correctly handle certain
memory operations, which could lead to a buffer overflow. A remote attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-2385)
Henning Westerholt discovered that Kamailio did not correctly handle
duplicated headers, which could lead to a segmentation fault. A remote
attacker could possibly use this issue to cause a denial of service or
execute arbitrary code. This issue only affected Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2018-14767)
It was discovered that Kamailio did not correctly handle parsing certain
headers containing whitespace characters. An authenticated attacker could
possibly use this issue to gain access to unauthorized resources and
expose sensitive information. This issue only affected Ubuntu 18.04 LTS
and Ubuntu 20.04 LTS. (CVE-2020-28361)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | kamailio | 4.3.4-1.1ubuntu2.1+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | kamailio | 5.1.2-1ubuntu2+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | kamailio | 5.3.2-1ubuntu0.1~esm2 |
Vulnerabilities 3
-
Unscored —
Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER …
-
Unscored —CVE-2018-14767 EPSS 29%
In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with a double "To" header and an empty "To" tag …
-
Unscored —
Kamailio before 5.4.0, as used in Sip Express Router (SER) in Sippy Softswitch 4.5 through 5.2 and other products, allo…