Description

SIPp through 3.7.7 contains a buffer overflow vulnerability in get_peer_tag() function when processing SIP To headers with tag parameters of 2049 bytes or more. Unauthenticated remote attackers can send crafted SIP messages with oversized tag parameters to overflow the static buffer and crash the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-13T12:17:16.837Z",
  "pubdate": "2026-09-13T12:17:16.837Z",
  "executiveSummary": "SIPp versions up to and including 3.7.7 contain a critical buffer overflow vulnerability within the get_peer_tag() function.\nThe vulnerability arises from improper bounds checking during the processing of SIP To headers containing tag parameters that exceed 2049 bytes.\nThis flaw allows an unauthenticated remote attacker to trigger a memory corruption event by sending a specifically crafted SIP message to the target system.\nSuccessful exploitation results in the overflow of a static buffer, which consistently leads to a process crash, effectively resulting in a Denial of Service (DoS) condition.\nThe vulnerability exists in the core SIP message parsing logic, exposing network-facing components to external exploitation without the requirement for prior authentication or elevated privileges.\nGiven the nature of the overflow, the risk is significant for high-availability signaling environments where SIPp is employed for load testing or traffic simulation.\nDefensive measures require upgrading to a patched release or implementing strict input validation and boundary constraints on all incoming SIP traffic at the network perimeter.",
  "technicalDetails": "The vulnerability resides in the get_peer_tag() function, a component responsible for parsing the tag parameter within the SIP 'To' header field. The implementation utilizes a static buffer with a fixed size to accommodate incoming tag data. The flaw is rooted in a failure to implement adequate boundary validation before copying input data from the SIP message header into this static buffer.\nWhen a remote attacker sends a SIP message containing a 'To' header with a tag parameter exceeding the 2049-byte threshold, the parsing logic fails to enforce length constraints, leading to a stack-based buffer overflow. This memory corruption overwrites adjacent stack memory, which corrupts the execution flow, instruction pointers, or critical process variables, causing the application to enter an undefined state and terminate abruptly.\nThe attack flow begins with the attacker constructing a malicious SIP packet. This packet encapsulates a crafted 'To' header where the 'tag' parameter is populated with a payload of 2049 bytes or more. Upon arrival at the target, the SIPp process initiates the parsing routine. The get_peer_tag() function identifies the tag parameter and attempts to move this data into the vulnerable static buffer. Because the length of the input exceeds the buffer's capacity, the excess data spills over into adjacent memory areas.\nThe vulnerability requires no authentication, meaning an unauthenticated attacker can target any reachable SIPp instance over the network. The exploitation is primarily characterized as a Denial of Service (DoS) attack, as the corrupted stack frames typically lead to an immediate process crash rather than reliable remote code execution. However, the integrity of the process memory is entirely compromised during the crash event. The exposure is limited to systems where SIPp is deployed and listening for incoming SIP traffic, making it a critical concern for infrastructure simulating or mediating SIP signaling.\nPost-exploitation impact is primarily limited to system instability and service disruption. Because SIPp is frequently used in performance and capacity testing, an unexpected crash during a test campaign can result in significant operational delays. Furthermore, while this analysis focuses on the DoS aspect, stack-based overflows frequently present a theoretical risk for memory corruption that could potentially be leveraged for more complex attacks if the target environment permits specific memory layout manipulation."
}