Description

sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-12T18:16:44.587Z",
  "pubdate": "2026-09-12T18:16:44.587Z",
  "executiveSummary": "sngrep versions up to and including 1.8.4 are susceptible to stack-based buffer overflow vulnerabilities originating from improper boundary validation during SIP header parsing. This vulnerability occurs when the application attempts to process SIP attribute values that exceed a pre-allocated 255-byte stack buffer. Exploitation of this flaw allows a remote, unauthenticated attacker to inject malicious SIP traffic, leading to service disruption via process crashes or potential remote code execution (RCE). The vulnerability resides within the packet parsing and rendering routines, which are typically exposed to any network segment capable of sending SIP traffic to the monitoring interface. Because the overflow occurs during the processing of packet metadata, it represents a high-risk security flaw for network diagnostic tools deployed in exposed environments. Impact includes system compromise, denial of service, and potential lateral movement if the sngrep instance is running with elevated privileges. No specific authentication is required to trigger the overflow, as the exploit is inherent in the handling of malformed inbound SIP packets.",
  "technicalDetails": "The vulnerability is a classic stack-based buffer overflow located within the SIP attribute formatting routines of sngrep. The root cause is a lack of bounds checking when copying SIP header data, such as Call-ID, X-Call-ID, or other custom header fields, into static buffers limited to 255 bytes. During the packet parsing lifecycle, sngrep extracts these fields to render the graphical display or save capture data. When an attacker sends a crafted SIP packet containing header values that exceed this defined limit, the strcpy or similar memory-copy operation writes beyond the stack buffer boundary.\nThe exploitation flow begins when the sngrep utility captures a malicious SIP packet from the network interface. The parsing engine proceeds to extract the targeted header field. Because the implementation relies on fixed-size stack allocation without verifying the input length against the destination buffer size, the excessive data overflows into adjacent memory regions on the stack. This overwrite can corrupt the return address or other critical control-flow metadata stored on the stack frame.\nSuccessful exploitation allows an attacker to control the instruction pointer (EIP/RIP) upon function return, providing the primitive necessary for hijacking the application's control flow. By crafting a specific payload within the header field, an attacker can redirect execution to arbitrary shellcode or perform a Return-Oriented Programming (ROP) chain to bypass security measures such as NX (No-Execute) bits. Given that sngrep often operates on high-traffic network segments to facilitate network troubleshooting, the attack surface is wide, and exploitation requires no interaction from a privileged user.\nThe vulnerability affects all versions up to 1.8.4. The impact is significant because sngrep is often used as a debugging tool, sometimes left running on production infrastructure. If the process is terminated due to memory corruption, the security implications regarding data availability are high. If arbitrary code execution is achieved, the attacker gains the execution context of the sngrep process, which may allow for further enumeration, traffic sniffing, or persistence within the host system. This defect highlights a fundamental flaw in the input validation logic within the packet processing subsystem, where trust is implicitly placed on the integrity and size of the incoming SIP header fields."
}