[Home]

Summary:ASTERISK-19770: Security Vulnerability: Segmentation fault when receiving an out-of-dialogue SIP UPDATE including a rpid info
Reporter:Thomas Arimont (tomaso)Labels:
Date Opened:2012-04-23 08:56:16Date Closed:2012-04-23 09:11:19
Priority:MajorRegression?
Status:Closed/CompleteComponents:Channels/chan_sip/Messaging
Versions:1.8.9.3 Frequency of
Occurrence
One Time
Related
Issues:
must be completed before resolvingASTERISK-19618 Asterisk 1.8.12.0 Blockers
must be completed before resolvingASTERISK-19619 Asterisk 10.4.0 Blockers
Environment:Attachments:( 0) ASTERISK-19278-2012-04-16.diff
( 1) backtrace.log
Description:If a '(for any reason) misdirected' SIP Update including a rpid info is received outside of a regular SIP Invite dialogue (and no associated channel is available, p->owner = NULL) a segmentation fault arises.
A NULL-pointer check for p->owner is missing in function handle_request_update().

Please see attached backtrace log and the attached related chan_sip.c module (since the used chan_sip.c is not exactly the mentioned affected version).
Comments: