Kamailio SIP Server Auth Module Out-of-Bounds Read Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in the auth module of Kamailio SIP Server, affecting versions prior to 6.0.5 and 5.8.7. The issue arises from an out-of-bounds read that allows remote attackers to crash the Kamailio process. This vulnerability is triggered by a specially crafted SIP packet, following a successful user authentication without a database backend, and additional user identity checks.

Impact

Exploitation of this vulnerability causes a process crash, leading to a denial-of-service condition on the affected system.

Remediation

Users are advised to update Kamailio to version 6.0.5 or 5.8.7. The latest two stable branches are supported, while older versions may receive occasional patches.