CVE-2023-36192
📋 TL;DR
CVE-2023-36192 is a heap buffer overflow vulnerability in sngrep v1.6.0 that allows attackers to execute arbitrary code or cause denial of service by sending specially crafted packets. This affects users running sngrep for SIP protocol analysis and packet capture. The vulnerability resides in the capture_ws_check_packet function in /src/capture.c.
💻 Affected Systems
- sngrep
📦 What is this software?
Sngrep by Irontec
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the sngrep process, potentially leading to full system compromise.
Likely Case
Application crash causing denial of service for SIP monitoring functionality.
If Mitigated
Limited impact if sngrep runs with minimal privileges and network exposure is restricted.
🎯 Exploit Status
Exploitation requires sending specially crafted packets to the vulnerable function, but no public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.6.1 or later
Vendor Advisory: https://github.com/irontec/sngrep/issues/438
Restart Required: Yes
Instructions:
1. Check current version with 'sngrep --version'. 2. Update using package manager: 'sudo apt update && sudo apt upgrade sngrep' (Debian/Ubuntu) or compile from source at https://github.com/irontec/sngrep. 3. Restart any running sngrep processes.
🔧 Temporary Workarounds
Disable packet capture
linuxStop using sngrep for live packet capture until patched
killall sngrep
systemctl stop sngrep
Network isolation
linuxRestrict network access to sngrep's capture interface
iptables -A INPUT -p tcp --dport 8080 -j DROP
ufw deny 8080
🧯 If You Can't Patch
- Run sngrep with minimal privileges using non-root accounts
- Implement network segmentation to isolate sngrep from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Run 'sngrep --version' and check if output shows version 1.6.0Check Version:
sngrep --versionVerify Fix Applied:
Run 'sngrep --version' and confirm version is 1.6.1 or higher📡 Detection & Monitoring
Log Indicators:
- Segmentation fault or crash logs from sngrep process
- Unexpected process termination of sngrep
Network Indicators:
- Unusual traffic patterns to sngrep's default port (8080)
- Malformed SIP packets targeting the capture interface
SIEM Query:
process_name="sngrep" AND (event_type="crash" OR exit_code="139")