CVE-2018-16657
Summary
| CVE | CVE-2018-16657 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2018-09-07 14:29:00 UTC |
|---|
| Updated | 2020-08-24 17:37:00 UTC |
|---|
| Description | In Kamailio before 5.0.7 and 5.1.x before 5.1.4, a crafted SIP message with an invalid Via header causes a segmentation fault and crashes Kamailio. The reason is missing input validation in the crcitt_string_array core function for calculating a CRC hash for To tags. (An additional error is present in the check_via_address core function: this function also misses input validation.) This could result in denial of service and potentially the execution of arbitrary code. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Advisory HW-2018-06 | skalatan.de |
MISC |
skalatan.de |
Exploit, Patch, Third Party Advisory |
| [SECURITY] [DLA 1503-1] kamailio security update |
MLIST |
lists.debian.org |
Mailing List, Third Party Advisory |
| Debian -- Security Information -- DSA-4292-1 kamailio |
DEBIAN |
www.debian.org |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 199477 Ubuntu Security Notification for Kamailio Vulnerabilities (USN-6022-1)
