CVE-2023-27597
📋 TL;DR
CVE-2023-27597 is a segmentation fault vulnerability in OpenSIPS SIP server that causes denial of service when processing specially crafted SIP messages. The crash occurs in the rewrite_ruri function and affects configurations using functions like setport. OpenSIPS administrators running vulnerable versions are affected.
💻 Affected Systems
- OpenSIPS
📦 What is this software?
Opensips by Opensips
Opensips by Opensips
⚠️ Risk & Real-World Impact
Worst Case
Complete service outage of SIP server leading to disruption of voice/video communications and related services
Likely Case
Service disruption requiring manual restart of OpenSIPS server
If Mitigated
Minimal impact with proper monitoring and automated recovery mechanisms
🎯 Exploit Status
Exploitation requires sending a specially crafted SIP message to trigger the segmentation fault
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.1.8 or 3.2.5
Vendor Advisory: https://github.com/OpenSIPS/opensips/security/advisories/GHSA-358f-935m-7p9c
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Upgrade to OpenSIPS 3.1.8 (for 3.1.x branch) or 3.2.5 (for 3.2.x branch). 3. Restart OpenSIPS service. 4. Verify service is running correctly.
🔧 Temporary Workarounds
Disable vulnerable functions
allRemove or disable configurations using setport or other functions that call rewrite_ruri
# Review opensips.cfg and remove/comment out lines using setport or similar functions
Network filtering
linuxImplement SIP message filtering to block malformed messages
# Use iptables or similar to filter suspicious SIP traffic
# Example: iptables -A INPUT -p udp --dport 5060 -m string --algo bm --hex-string '|pattern|' -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to limit SIP traffic to trusted sources only
- Deploy monitoring and automated restart mechanisms to minimize downtime from crashes
🔍 How to Verify
Check if Vulnerable:
Check OpenSIPS version and review configuration for use of setport or similar functionsCheck Version:
opensips -VVerify Fix Applied:
Verify OpenSIPS version is 3.1.8 or higher (3.1.x branch) or 3.2.5 or higher (3.2.x branch)📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in OpenSIPS logs
- Unexpected process termination
- Core dump files
Network Indicators:
- Unusual SIP message patterns
- Multiple connection attempts with malformed SIP headers
SIEM Query:
source="opensips.log" AND ("segmentation fault" OR "core dumped" OR "SIGSEGV")🔗 References
- https://github.com/OpenSIPS/opensips/commit/b2dffe4b5cd81182c9c8eabb6c96aac96c7acfe3
- https://github.com/OpenSIPS/opensips/security/advisories/GHSA-358f-935m-7p9c
- https://github.com/OpenSIPS/opensips/commit/b2dffe4b5cd81182c9c8eabb6c96aac96c7acfe3
- https://github.com/OpenSIPS/opensips/security/advisories/GHSA-358f-935m-7p9c
