SIPp Buffer Overflow Vulnerability Allowing Code Execution or Application Crash

A local buffer overflow vulnerability has been identified in SIPp versions through 3.6. This vulnerability arises from improper handling of command-line arguments, specifically the -3pcc, -i, and -log_file parameters. The issue allows local attackers to cause application crashes or execute arbitrary code by supplying oversized input, which is mishandled by the strcpy function, leading to memory corruption.

Impact

Exploitation of this vulnerability can result in a local application crash or arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using SIPp 3.6 or an earlier version. Oversized input can be sent through the -3pcc, -i, or -log_file command-line parameters. This input will overflow the buffer, allowing for potential code execution or causing the application to crash.