Description

A vulnerability was detected in Kamailio up to 6.0.7/6.1.3. The affected element is the function isup_get_calling_party of the file src/modules/sipt/ss7_parser.c of the component sipt Module. The manipulation of the argument length results in buffer overflow. The attack may be performed from remote. Upgrading to version 6.0.8 and 6.1.4 is sufficient to fix this issue. The patch is identified as 3667bebf8d0bea07ed16218fd921d07db87aeb21. Upgrading the affected component is advised.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-12T10:16:44.170Z",
  "pubdate": "2026-10-12T10:16:44.170Z",
  "executiveSummary": "A buffer overflow vulnerability exists in the sipt module of Kamailio, specifically within the isup_get_calling_party function. This security flaw stems from the improper handling of the length argument during the parsing of SS7 protocol data.\nThe vulnerability allows remote attackers to trigger a buffer overflow, which can lead to application crashes (Denial of Service) or potential arbitrary code execution depending on the state of the memory at the time of exploitation.\nAffected versions include Kamailio up to 6.0.7 and 6.1.3. The flaw is reachable via remote network vectors, making it a significant risk for deployments handling signaling traffic.\nSuccessful exploitation requires the attacker to submit a specially crafted packet that triggers the flawed length validation logic within the sipt module. As Kamailio often runs with elevated privileges to bind to network ports, successful exploitation could lead to full system compromise.\nThe security risk is high due to the potential for remote exploitation and the critical nature of the affected signaling parsing logic. Organizations utilizing the sipt module must prioritize patching to version 6.0.8 or 6.1.4 to mitigate this risk.",
  "technicalDetails": "The vulnerability resides in the src/modules/sipt/ss7_parser.c file within the sipt module, specifically affecting the isup_get_calling_party function. The root cause is a classic buffer overflow condition resulting from insufficient validation of the length parameter when parsing SS7 (Signaling System No. 7) payloads.\nDuring the processing of ISUP (ISDN User Part) calling party information, the parser accepts a length argument that is intended to define the size of the data to be copied into a statically allocated or fixed-size memory buffer. The function fails to perform adequate bounds checking to ensure that the provided length does not exceed the destination buffer capacity. Consequently, if an attacker provides a length value that exceeds the predefined limits, the memory copy operation will overwrite adjacent memory segments.\nThe attack flow initiates when the Kamailio server receives an SS7/ISUP signaling packet over the network. The sipt module, responsible for decoding these headers, invokes isup_get_calling_party to extract the calling party information. By crafting a malicious packet with a header containing a manipulated length field, the attacker forces the function to perform an out-of-bounds write. Because the module is exposed to remote input, an attacker can trigger this condition without prior authentication.\nThe technical impact of the buffer overflow depends on the heap or stack layout at runtime. An out-of-bounds write can corrupt function pointers, return addresses, or critical data structures managed by the Kamailio process. If successful, this can lead to a crash resulting in a Denial of Service (DoS) of the signaling gateway, or potentially remote code execution (RCE) if the attacker can influence the overwritten memory to hijack the control flow of the application.\nThis vulnerability is identified by patch 3667bebf8d0bea07ed16218fd921d07db87aeb21. The fix involves implementing rigorous length validation before the data copy occurs, ensuring that the length argument is verified against the actual buffer size before any memory operations are permitted. Kamailio instances that do not require SS7/ISUP parsing functionality are encouraged to disable the sipt module entirely to reduce the attack surface until the patch is applied."
}