Published: 11/04/2016 Updated: 09/10/2018

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) prior to 4.3.5 allows remote malicious users to cause a denial of service (memory corruption and process crash) or possibly execute arbitrary code via a large SIP packet.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 8.0
kamailio kamailio

Debian Bug report logs - #815178 kamailio: CVE-2016-2385: SEAS Module Heap overflow Package: src:kamailio; Maintainer for src:kamailio is Debian VoIP Team <pkg-voip-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 19 Feb 2016 18:00:15 UTC Severity: grave Tags: fix ...

Stelios Tsampas discovered a buffer overflow in the Kamailio SIP proxy which might result in the execution of arbitrary code For the stable distribution (jessie), this problem has been fixed in version 420-2+deb8u1 For the testing distribution (stretch), this problem has been fixed in version 434-2 For the unstable distribution (sid), this p ...

census ID: census-2016-0009 CVE ID: CVE-2016-2385 Affected Products: Kamailio 434 (and possibly previous versions) Class: Heap-based Buffer Overflow (CWE-122) Remote: Yes Discovered by: Stelios Tsampas Kamailio (successor of former OpenSER and SER) is an Open Source SIP Server released under GPL, able to handle thousands of call setups per second ...

CWE-119 http://www.debian.org/security/2016/dsa-3535 http://packetstormsecurity.com/files/136477/Kamailio-4.3.4-Heap-Overflow.html http://www.debian.org/security/2016/dsa-3537 https://census-labs.com/news/2016/03/30/kamailio-seas-heap-overflow/https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643 http://www.kamailio.org/pub/kamailio/4.3.5/ChangeLog https://www.exploit-db.com/exploits/39638/http://www.securityfocus.com/archive/1/537926/100/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815178 https://nvd.nist.gov https://www.exploit-db.com/exploits/39638/https://www.debian.org/security/./dsa-3535

CVE-2016-2385

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect