CVE-2023-31982
📋 TL;DR
CVE-2023-31982 is a heap buffer overflow vulnerability in sngrep v1.6.0 that allows attackers to execute arbitrary code or cause denial of service by sending specially crafted network packets. This affects anyone using sngrep to analyze SIP traffic in vulnerable configurations. The vulnerability resides in the capture_packet_reasm_ip function in capture.c.
💻 Affected Systems
- sngrep
📦 What is this software?
Sngrep by Irontec
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the sngrep process, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) when processing malformed network packets.
If Mitigated
Limited impact if sngrep runs with minimal privileges and network exposure is restricted.
🎯 Exploit Status
Exploitation requires sending specially crafted network packets to the system where sngrep is running and capturing traffic.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.6.1 and later
Vendor Advisory: https://github.com/irontec/sngrep/issues/431
Restart Required: Yes
Instructions:
1. Stop any running sngrep processes. 2. Update sngrep to version 1.6.1 or later using your package manager or compile from source. 3. Verify the new version is installed.
🔧 Temporary Workarounds
Disable packet reassembly
linuxRun sngrep with packet reassembly disabled to avoid the vulnerable code path
sngrep --no-reassembly
Restrict network exposure
allOnly run sngrep on trusted networks and limit packet capture to necessary interfaces
sngrep -i eth0 (specify trusted interface only)
🧯 If You Can't Patch
- Run sngrep with reduced privileges (non-root user) to limit impact of potential exploitation
- Isolate sngrep to dedicated monitoring VLANs and restrict network access to necessary SIP traffic only
🔍 How to Verify
Check if Vulnerable:
Check sngrep version: sngrep --version | grep -i versionCheck Version:
sngrep --versionVerify Fix Applied:
Confirm version is 1.6.1 or higher: sngrep --version📡 Detection & Monitoring
Log Indicators:
- sngrep segmentation faults
- unexpected sngrep process termination
- core dumps from sngrep
Network Indicators:
- Unusual malformed SIP packets targeting monitoring systems
- Traffic spikes to ports where sngrep is capturing
SIEM Query:
process:sngrep AND (event_type:crash OR exit_code:139 OR exit_code:11)