CVE-2021-43303
📋 TL;DR
This vulnerability allows remote code execution via a buffer overflow in the PJSUA API's pjsua_call_dump function. Attackers can exploit it by providing a buffer smaller than 128 characters, causing overflow regardless of the maxlen argument. Systems using vulnerable versions of pjproject/PJSIP are affected.
💻 Affected Systems
- pjproject
- PJSIP
📦 What is this software?
Pjsip by Teluu
⚠️ Risk & Real-World Impact
Worst Case
Remote attackers can execute arbitrary code with the privileges of the PJSIP process, potentially leading to complete system compromise.
Likely Case
Remote code execution leading to service disruption, data exfiltration, or lateral movement within the network.
If Mitigated
With proper input validation and buffer size checks, exploitation would be prevented, limiting impact to denial of service at most.
🎯 Exploit Status
The vulnerability is straightforward to exploit due to predictable buffer overflow conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.12 and later
Vendor Advisory: https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9
Restart Required: Yes
Instructions:
1. Update pjproject to version 2.12 or later. 2. Recompile any applications using PJSIP. 3. Restart affected services.
🔧 Temporary Workarounds
Disable vulnerable function
allRemove or disable calls to pjsua_call_dump in application code.
🧯 If You Can't Patch
- Implement strict input validation for buffer arguments in application code.
- Use memory protection mechanisms like ASLR and DEP to reduce exploit success.
🔍 How to Verify
Check if Vulnerable:
Check pjproject version with 'pkg-config --modversion pjproject' or examine source code for version < 2.12.Check Version:
pkg-config --modversion pjprojectVerify Fix Applied:
Confirm version is 2.12 or later and verify pjsua_call_dump calls use proper buffer size validation.📡 Detection & Monitoring
Log Indicators:
- Crash logs from PJSIP processes
- Unexpected process termination
Network Indicators:
- Unusual SIP traffic patterns
- Exploit attempts against SIP ports
SIEM Query:
source="*pjsip*" AND (event_type="crash" OR event_type="buffer_overflow")🔗 References
- https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://www.debian.org/security/2022/dsa-5285
- https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://www.debian.org/security/2022/dsa-5285
