SIPGO Library Nil Pointer Dereference Vulnerability in Response Handling Function Allows Denial-of-Service

A nil pointer dereference vulnerability has been identified in the SIPGO library, specifically in the 'NewResponseFromRequest' function. This issue affects all normal SIP operations in versions 0.3.0 prior to 1.0.0-alpha-1. The vulnerability allows remote attackers to crash any SIP application using this library by sending a malformed SIP request that lacks a To header. The problem arises because the response creation process assumes the To header is present, leading to a nil pointer dereference when the assumption is incorrect. This vulnerability disrupts routine SIP functions such as call setup, authentication, and message handling.

Impact

Exploitation of this vulnerability causes a complete denial-of-service, crashing the application immediately. The vulnerability can be exploited remotely and does not require authentication.

Reproduction

To reproduce this vulnerability, send a SIP REGISTER request to a SIP application using the vulnerable SIPGO library, ensuring that the request does not include a To header. The application will crash due to the nil pointer dereference.

Remediation

Users can upgrade to SIPGO version 1.0.0-alpha-1, which includes a patch for this vulnerability.