Description

SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with oversized algorithm parameters. A malicious SIP server can send a crafted 401 or 407 challenge to corrupt the stack and crash the client process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-13T12:17:16.960Z",
  "pubdate": "2026-09-13T12:17:16.960Z",
  "executiveSummary": "SIPp versions through 3.7.7 are susceptible to a stack-based buffer overflow vulnerability residing within the createAuthHeader() function.\nThe vulnerability occurs during the processing of SIP authentication challenges, specifically when handling the algorithm parameter.\nA remote attacker, acting as a malicious SIP server, can exploit this flaw by sending a crafted 401 Unauthorized or 407 Proxy Authentication Required response containing an oversized algorithm parameter.\nSuccessful exploitation results in memory corruption on the stack, which can lead to a denial-of-service (DoS) condition via process crash or potential arbitrary code execution depending on the execution environment.\nThis vulnerability is particularly critical for SIPp deployments that interact with untrusted or potentially compromised SIP endpoints or proxies.\nThe attack is network-exposed, requiring no prior authentication from the client, as the vulnerability is triggered during the standard SIP handshake process when the client receives an authentication challenge.\nUsers are advised to identify impacted instances and monitor for software updates that address this stack management issue.",
  "technicalDetails": "The vulnerability is localized within the createAuthHeader() function, which is responsible for generating the Authorization header in SIP requests following the receipt of an authentication challenge.\nThe root cause is an insecure handling of the 'algorithm' parameter extracted from the incoming 401 or 407 challenge messages. The implementation fails to perform adequate bounds checking when copying this parameter into a fixed-size stack buffer.\nWhen a SIPp client receives a challenge, it parses the authentication headers to extract parameters such as realm, nonce, and algorithm. If an attacker provides an algorithm string exceeding the allocated buffer capacity, a classic stack-based buffer overflow occurs.\nThe attack flow begins when the SIPp client sends an initial request to a remote server. The server responds with a malicious SIP 401/407 message where the algorithm parameter is padded with a payload designed to overwrite adjacent stack memory, including the function's return address.\nBecause the buffer resides on the stack, the overflow allows for the corruption of saved registers and the return address. Upon the completion of the createAuthHeader() function, the corrupted return address is loaded into the instruction pointer (IP/EIP/RIP), redirecting control flow to attacker-controlled memory or causing an immediate segmentation fault due to invalid memory access.\nThe vulnerability affects SIPp versions up to and including 3.7.7. The impact is significant as it affects the core protocol parsing logic of the client. As SIPp is frequently used for load testing and performance benchmarking, this flaw could be leveraged to disrupt testing infrastructure or compromise the host environment.\nThere are no specific privilege requirements for the attacker, as the attack is inherently network-based and exploits a standard protocol interaction. The payload behavior is limited by the protocol framing, but the nature of stack corruption suggests that if the environment lacks modern exploit mitigations like Stack Canaries or Address Space Layout Randomization (ASLR), remote code execution might be achievable.\nPost-exploitation impact includes the abrupt termination of the SIPp process, leading to a denial-of-service of the benchmarking activity or, in scenarios where the process is running with elevated privileges, potential full system compromise."
}