CVE-2024-3119

What it actually does

Buffer overflow in sip_get_callid and sip_get_xcallid functions allows remote attackers to overwrite memory via oversized Call-ID or X-Call-ID SIP headers copied with strncpy into fixed buffers without length validation, enabling arbitrary code execution or denial of service.

Why it matters to the business

Attackers can remotely crash or fully compromise systems running sngrep, disrupting SIP traffic analysis operations and potentially allowing persistent unauthorized access across networks that rely on this tool for VoIP diagnostics.

How an attack unfolds

An attacker sends a specially crafted SIP INVITE or other message containing an excessively long Call-ID or X-Call-ID header value to a network-visible sngrep instance; the vulnerable strncpy calls in sip.c overflow the stack or heap buffer, hijacking control flow to execute attacker-supplied code or crash the process.

How to fix it

Upgrade irontec/sngrep to the commit 373abb90804ba71f980c7120e62f90d3a5c81213 or later release; rebuild from source if using GIT checkout and verify the fix is present in sip.c before redeploying.

How to confirm the fix worked

Confirm the running binary or source matches the fixed commit hash, recompile with the patch, and test header parsing with boundary-case SIP messages containing maximum-length and oversized Call-ID values to ensure no overflow occurs.

Typical attack path

1. Scan for exposed sngrep instances or SIP endpoints that feed traffic into the tool
2. Craft a malicious SIP message embedding an oversized Call-ID or X-Call-ID header
3. Transmit the message over UDP/TCP to trigger header parsing in sip.c
4. Achieve memory corruption leading to code execution or denial of service

How to detect it

Review sngrep process logs and system crash dumps for segmentation faults during SIP header parsing, inspect incoming SIP traffic for abnormally long Call-ID or X-Call-ID values, and correlate with network captures showing repeated malformed INVITE messages.

• sngrep segmentation fault
• Call-ID header exceeding 256 bytes
• X-Call-ID header exceeding 256 bytes
• sip_get_callid
• sip_get_xcallid

What your security team should do

• Immediately update all sngrep deployments to the fixed commit
• Restrict sngrep exposure to trusted SIP traffic sources only
• Monitor for unusual process crashes or high CPU in sngrep instances
• Add network segmentation for VoIP analysis hosts