Virtual Event Today: Supply Chain Security Summit - Register Now

Security Experts:

Connect with us

Hi, what are you looking for?


IoT Security

Vulnerability Allows Remote DoS Attacks Against Apps Using Linphone SIP Stack

A serious vulnerability affecting the Linphone Session Initiation Protocol (SIP) client suite can allow malicious actors to remotely crash applications, industrial cybersecurity firm Claroty warned on Tuesday.

A serious vulnerability affecting the Linphone Session Initiation Protocol (SIP) client suite can allow malicious actors to remotely crash applications, industrial cybersecurity firm Claroty warned on Tuesday.

SIP is a signaling protocol designed for initiating, maintaining and terminating communication sessions. The protocol is often used for voice, video, instant messaging, and other types of applications.

The Linphone SIP client developed and maintained by France-based Belledonne Communications is open source and widely used. According to the official website, Linphone, which has been around for 20 years, has more than 200 corporate customers. Linphone solutions have been used by organizations in the IoT, telecoms, secure communications, home automation, social networking, and telepresence sectors. The website lists BT, Swisscom and Acer as customers.

An analysis of the Linphone SIP client suite conducted by Claroty revealed the existence of a vulnerability in the Belle-sip library. The flaw was patched with the release of version 4.5.20 a few months ago, and Claroty this week made public the technical details of the issue.

The security hole, tracked as CVE-2021-33056 and described as a NULL pointer dereference, can be exploited remotely and without user interaction by sending a specially crafted INVITE request to the targeted client. Exploitation causes the client to crash, creating a denial of service (DoS) condition.

INVITE requests are used to initiate a dialog for establishing a call, and SIP clients are configured to listen for these types of requests from other clients. The requests go from the initiating client to the invited client through the SIP server.

“All that is needed to exploit this remotely is to send to any SIP client in the network an INVITE SIP request with a specifically crafted From/To/Diversion header that will trigger the NULL pointer dereference vulnerability. Any application that uses belle-sip under the hood to parse SIP messages is vulnerable and will crash upon receiving a malicious SIP ‘call’,” Claroty explained.

While the vulnerability has been fixed in the core protocol stack, Claroty pointed out that it’s important for downstream vendors to patch their products as well.

Related: Vulnerabilities in TBox RTUs Can Expose Industrial Organizations to Remote Attacks

Related: Newly Disclosed Vulnerability Allows Remote Hacking of Siemens PLCs

Related: Vulnerability Found in Industrial Remote Access Product From Claroty

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.


GoAnywhere MFT users warned about a zero-day remote code injection exploit that can be targeted directly from the internet