Kamailio Out-of-Bounds Access Vulnerability in Core TCP Data Processing Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in Kamailio, an open-source SIP signaling server, prior to versions 6.1.1, 6.0.6, and 5.8.8. The issue arises from an out-of-bounds access in the core of Kamailio, allowing remote attackers to cause a process crash by sending specially crafted data packets over TCP. This vulnerability affects Kamailio instances with TCP or TLS listeners.

Impact

Exploitation of this vulnerability leads to a process crash, causing a denial-of-service condition on the affected Kamailio instance.

Remediation

Users are advised to update to Kamailio versions 6.1.1, 6.0.6, or 5.8.8. Older Kamailio instances may receive occasional patches, but users must maintain their installation from the Git repository, as packages are only built for the last two stable branches.