CVE-2024-3120

What it actually does

Stack-based buffer overflow due to missing bounds checks on 'Content-Length' and 'Warning' SIP headers inside sip_validate_packet and sip_parse_extra_headers, resulting in memory corruption that can yield arbitrary code execution or denial of service.

Why it matters to the business

Remote attackers can compromise systems running SIP analysis tools, enabling code execution on monitoring hosts and potential disruption of VoIP troubleshooting or security operations.

How an attack unfolds

An attacker sends a crafted SIP message containing oversized Content-Length or Warning headers to a vulnerable sngrep process; the headers are copied into fixed-size stack buffers without length validation, corrupting adjacent memory and allowing control-flow hijacking or a crash.

How to fix it

Upgrade irontec/sngrep to commit 373abb90804ba71f980c7120e62f90d3a5c81213 or later. For debauchee/barrier update to commit 229abab99f39f11624e5651f819e7f1f8eddedcc. Apply patches or rebuild from the fixed source.

How to confirm the fix worked

Confirm the installed commit or version matches the fixed hash. Perform negative testing with boundary-exceeding SIP headers and verify absence of crashes or unexpected behavior.

Typical attack path

1. Locate an exposed sngrep instance accepting SIP traffic
2. Construct a SIP packet with excessively long header values
3. Transmit the packet to trigger the overflow in header parsing
4. Leverage memory corruption for code execution or service denial

How to detect it

Review sngrep process logs and system crash dumps for segmentation faults during SIP header parsing. Correlate with network captures showing SIP messages containing abnormally large Content-Length or Warning fields.

• sngrep segmentation fault
• sip_validate_packet
• sip_parse_extra_headers
• oversized Content-Length header
• oversized Warning header

What your security team should do

• Apply the listed upstream commits immediately on all affected deployments
• Restrict inbound SIP access to sngrep instances to trusted sources only
• Add network-level filtering for malformed or oversized SIP headers
• Monitor build pipelines for downstream packages that embed the vulnerable code