Asterisk
  1. Asterisk
  2. ASTERISK-28465

Broken SDP can cause a segfault in a T.38 reINVITE

    Details

    • Regression:
      No

      Description

      Our gateways (asterisk-13 based) experienced occasional segfaults last days, and inspecting with GDB their coredumps, we finally concluded they are caused by a very specific case in process_sdp() of chan_sip.c:

      1) Asterisk has been configured with preferred_codec_only for the relevant peer, and e list, possibly restrictive, of codecs
      2) the SIP peer starts a valid session through Asterisk (chan_sip) as a B2BUA
      3) Asterisk issue a T.38 reINVITE (for example with ReceiveFAX application, even if it was not our case)
      4) the SIP UA (UAS in this case) responds with a "broken" SDP with two m-lines, one for an audio codec not included in the SIP peer allowed list, and another with image/t38

      Such an SDP is broken because a SIP UA is not allowed to responds with multiple m-lines whenever it received just one m-line.

      We reproduced it on a lab with SIPp and the last version 13 released (13.27.0), but I see no change on that part of code also on master.

      The reason I choose to tag it as a security issue, is that:

      • with specific configurations
      • a malevolent, authenticated (it can setup a call through the Asterisk server) user
      • can tear down the service

      But I'm not sure it is so serious: I'm inviting you to properly change it.

        Issue Links

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

          Hide
          Friendly Automation added a comment -

          Change 11551 merged by Benjamin Keith Ford:
          chan_sip: Handle invalid SDP answer to T.38 re-invite

          https://gerrit.asterisk.org/c/asterisk/+/11551

          Show
          Friendly Automation added a comment - Change 11551 merged by Benjamin Keith Ford: chan_sip: Handle invalid SDP answer to T.38 re-invite https://gerrit.asterisk.org/c/asterisk/+/11551
          Hide
          Friendly Automation added a comment -

          Change 11554 merged by Benjamin Keith Ford:
          chan_sip: Handle invalid SDP answer to T.38 re-invite

          https://gerrit.asterisk.org/c/asterisk/+/11554

          Show
          Friendly Automation added a comment - Change 11554 merged by Benjamin Keith Ford: chan_sip: Handle invalid SDP answer to T.38 re-invite https://gerrit.asterisk.org/c/asterisk/+/11554
          Hide
          Friendly Automation added a comment -

          Change 11553 merged by Benjamin Keith Ford:
          chan_sip: Handle invalid SDP answer to T.38 re-invite

          https://gerrit.asterisk.org/c/asterisk/+/11553

          Show
          Friendly Automation added a comment - Change 11553 merged by Benjamin Keith Ford: chan_sip: Handle invalid SDP answer to T.38 re-invite https://gerrit.asterisk.org/c/asterisk/+/11553
          Hide
          Friendly Automation added a comment -

          Change 11552 merged by Benjamin Keith Ford:
          chan_sip: Handle invalid SDP answer to T.38 re-invite

          https://gerrit.asterisk.org/c/asterisk/+/11552

          Show
          Friendly Automation added a comment - Change 11552 merged by Benjamin Keith Ford: chan_sip: Handle invalid SDP answer to T.38 re-invite https://gerrit.asterisk.org/c/asterisk/+/11552
          Hide
          Friendly Automation added a comment -

          Change 11559 merged by Kevin Harwell:
          chan_sip: Handle invalid SDP answer to T.38 re-invite

          https://gerrit.asterisk.org/c/asterisk/+/11559

          Show
          Friendly Automation added a comment - Change 11559 merged by Kevin Harwell: chan_sip: Handle invalid SDP answer to T.38 re-invite https://gerrit.asterisk.org/c/asterisk/+/11559

            People

            • Watchers:
              5 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: