A serious vulnerability affecting the Linphone Session Initiation Protocol (SIP) client suite can allow malicious actors to remotely crash applications, industrial cybersecurity firm Claroty warned on Tuesday.
SIP is a signaling protocol designed for initiating, maintaining and terminating communication sessions. The protocol is often used for voice, video, instant messaging, and other types of applications.
The Linphone SIP client developed and maintained by France-based Belledonne Communications is open source and widely used. According to the official website, Linphone, which has been around for 20 years, has more than 200 corporate customers. Linphone solutions have been used by organizations in the IoT, telecoms, secure communications, home automation, social networking, and telepresence sectors. The website lists BT, Swisscom and Acer as customers.
An analysis of the Linphone SIP client suite conducted by Claroty revealed the existence of a vulnerability in the Belle-sip library. The flaw was patched with the release of version 4.5.20 a few months ago, and Claroty this week made public the technical details of the issue.
The security hole, tracked as CVE-2021-33056 and described as a NULL pointer dereference, can be exploited remotely and without user interaction by sending a specially crafted INVITE request to the targeted client. Exploitation causes the client to crash, creating a denial of service (DoS) condition.
INVITE requests are used to initiate a dialog for establishing a call, and SIP clients are configured to listen for these types of requests from other clients. The requests go from the initiating client to the invited client through the SIP server.
“All that is needed to exploit this remotely is to send to any SIP client in the network an INVITE SIP request with a specifically crafted From/To/Diversion header that will trigger the NULL pointer dereference vulnerability. Any application that uses belle-sip under the hood to parse SIP messages is vulnerable and will crash upon receiving a malicious SIP ‘call’,” Claroty explained.
While the vulnerability has been fixed in the core protocol stack, Claroty pointed out that it’s important for downstream vendors to patch their products as well.
Related: Vulnerabilities in TBox RTUs Can Expose Industrial Organizations to Remote Attacks
Related: Newly Disclosed Vulnerability Allows Remote Hacking of Siemens PLCs
Related: Vulnerability Found in Industrial Remote Access Product From Claroty
