<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
h4
{mso-style-priority:9;
mso-style-link:"Überschrift 4 Zchn";
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Calibri",sans-serif;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.qt-
{mso-style-name:qt-;}
span.berschrift4Zchn
{mso-style-name:"Überschrift 4 Zchn";
mso-style-priority:9;
mso-style-link:"Überschrift 4";
font-family:"Calibri Light",sans-serif;
color:#2F5496;
font-style:italic;}
span.size
{mso-style-name:size;}
span.E-MailFormatvorlage24
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:555971814;
mso-list-template-ids:-1281088718;}
@list l0:level1
{mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level2
{mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level3
{mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level4
{mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level5
{mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level6
{mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level7
{mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level8
{mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l0:level9
{mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1
{mso-list-id:759835076;
mso-list-type:hybrid;
mso-list-template-ids:674251538 67567631 67567641 67567643 67567631 67567641 67567643 67567631 67567641 67567643;}
@list l1:level1
{mso-level-start-at:2;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l1:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l2
{mso-list-id:998116826;
mso-list-type:hybrid;
mso-list-template-ids:-509195164 67567633 67567641 67567643 67567631 67567641 67567643 67567631 67567641 67567643;}
@list l2:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l2:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l2:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l2:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l3
{mso-list-id:1967352789;
mso-list-template-ids:776137616;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hello Sandro,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">thanks for sharing the writeup and for the work you do.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">I think everything has been said at least a few times in this thread, so I will not comment long. Just two remarks:<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">1. As mentioned before, if people want to participate in the project in this particular area, just let us know. So far there has been no feedback.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">2. I think it would be good to take the proper time to analyse bugs before publishing about them. To quote from your post:<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-GB">“For example, consider these two separate fixes that were applied earlier this year. [..] Might they have security implications? Most certainly (although we’re
not sure and have not verified).”<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">I am sorry, but this sounds more like guessing to me. Especially if a compare it to some of your other work that I am aware of (e.g. were you provided proof of concept code for a vulnerability
etc..).<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Cheers,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Henning<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">-- <o:p>
</o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Henning Westerholt –
</span><span style="mso-fareast-language:EN-US"><a href="https://skalatan.de/blog/"><span lang="EN-GB" style="color:#0563C1">https://skalatan.de/blog/</span></a></span><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Kamailio services –
</span><span style="mso-fareast-language:EN-US"><a href="https://gilawa.com/"><span lang="EN-GB" style="color:#0563C1">https://gilawa.com</span></a></span><span style="mso-fareast-language:EN-US">
<span lang="EN-GB"><o:p></o:p></span></span></p>
</div>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-left:35.4pt"><b>From:</b> sr-users <sr-users-bounces@lists.kamailio.org>
<b>On Behalf Of </b>Sandro Gauci<br>
<b>Sent:</b> Tuesday, September 22, 2020 11:32 AM<br>
<b>To:</b> sr-users@lists.kamailio.org<br>
<b>Subject:</b> Re: [SR-Users] Kamailio vulnerable to header smuggling possible due to bypass of remove_hf<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">I know I am waking up an old debate by replying to this thread. Deeply sorry :-)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Finally got around to writing up a blog post about this very thread where I (think) I spared absolutely no one, not even myself.
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">My post is called "The great Kamailio security debate and some misconceptions debunked" and can be read here:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><a href="https://www.rtcsec.com/2020/09/02-kamailio-security-debate-and-misconceptions/">https://www.rtcsec.com/2020/09/02-kamailio-security-debate-and-misconceptions/</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">The ToC:<o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Introduction<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>A bit of background before diving in<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">3.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Claim: this issue does not affect many organisations<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">4.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Claim: custom headers are only known to internal users<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">5.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Claim: if it’s an 18 year old bug, it can’t have been high risk<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">6.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Claim: this should have been found if people were doing proper testing<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">7.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Claim: infrequent advisories = project is not serious about security<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">8.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Claim: limited number of advisories = project is more secure<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">9.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Claim: if you’re serious about security, monitor the mailing lists<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">10.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Claim: security experts should decide what is a security vulnerability<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">11.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Discussion: when should the project publish an advisory?<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">12.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Discussion: educational security role<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:71.4pt;text-indent:-18.0pt;mso-list:l0 level1 lfo1">
<![if !supportLists]><span style="mso-list:Ignore">13.<span style="font:7.0pt "Times New Roman"">
</span></span><![endif]>Moving forward<o:p></o:p></p>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Hope that it is at least interesting and perhaps even constructive!<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Best wishes,<o:p></o:p></p>
</div>
<div id="sig45665722">
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">--<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> Sandro Gauci, CEO at Enable Security GmbH<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> Register of Companies: AG Charlottenburg HRB 173016 B<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> Company HQ: Pappelallee 78/79, 10437 Berlin, Germany<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> PGP/Encrypted comms: <a href="https://keybase.io/sandrogauci">
https://keybase.io/sandrogauci</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> Our blog:
<a href="https://www.rtcsec.com">https://www.rtcsec.com</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"> Other points of contact:
<a href="https://enablesecurity.com/#contact-us">https://enablesecurity.com/#contact-us</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">On Thu, 3 Sep 2020, at 10:34 AM, Olle E. Johansson wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt;overflow-wrap:break-word" id="qt">
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Well, you have defined one definitive line between being stupid and following some current practise :-)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">I like to think we as a project have an educational role as well. In this case explaining the bug we had and what it can cause.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">We should definitely add a warning along the lines you write too - relying on headers alone is bad and not best current practise.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">/O<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-left:35.4pt">On 3 Sep 2020, at 10:14, davy van de moere <<a href="mailto:davy.van.de.moere@gmail.com">davy.van.de.moere@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">After 20 years in voip, my 2 cents on this, if you succeed in creating a voip system where the security of the whole relies on the ability to remove (or only keep specific) custom sip headers, you will wake up
one morning realizing a bunch of people in Palestine made a gazillion calls over your system to expensive destinations, bringing you to or over the edge of bankruptcy.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Security should be multilayered, one header sneaking through should not give any big problems. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">From a security point of view, this could be called a 'normal' security risk, I think. It's a bit more than low as you can do more than just get some info, but it's not high, as you would need to have many other
factors going wrong to get to a successful exploit. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Op do 3 sep. 2020 om 09:18 schreef Olle E. Johansson <<a href="mailto:oej@edvina.net">oej@edvina.net</a>>:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">One thought - we may have to separate security vulnerability reporting from security advisory documents. I think in some cases, where a common use of a product can lead to issues (but it is not clearly a bug that
cause crashes in our code) we may have to send out an advisory and publish it in the same way. The problem with that is where the border is between just doing stupid things like taking SQL statements from SIP headers and issues like this that are harder to
catch.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">We had a long and hard discussion about this in the Asterisk project many years ago - a very common dialplan construct (that was documented in many places) was indeed very dangerous. It wasn’t any code in asterisk
that caused the issue, just a common dialplan construct that existed in many, many production systems. In the end, if I remember correctly, the project issued an advisory and added a README about it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Maybe that’s a way forward.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">/O<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal" style="margin-left:35.4pt">On 2 Sep 2020, at 21:25, Henning Westerholt <<a href="mailto:hw@skalatan.de" target="_blank">hw@skalatan.de</a>> wrote:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-">Hello Maxim,</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"> </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">have a look to the first sentence:</span></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB"> </span></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">“A security vulnerability is (for example) when a user of Kamailio can cause Kamailio to crash or lock up by sending messages to the server process.”</span></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB"> </span></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">So there is some limitation regarding vulnerability criticality defined in there. But of course (as I already mentioned), it might be improved to e.g. use CVSS scoring instead.</span></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB"> </span></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">Cheers,</span></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB"> </span></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">Henning</span></span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB"> </span></span><o:p></o:p></p>
</div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><b><span lang="EN-GB">From:</span></b></span><span class="qt-"><span lang="EN-GB"> Maxim Sobolev <<a href="mailto:sobomax@sippysoft.com" target="_blank">sobomax@sippysoft.com</a>> </span></span><span lang="EN-GB"><br>
<span class="qt-"><b>Sent:</b> Wednesday, September 2, 2020 9:15 PM</span><br>
<span class="qt-"><b>To:</b> Henning Westerholt <<a href="mailto:hw@skalatan.de" target="_blank">hw@skalatan.de</a>></span><br>
<span class="qt-"><b>Cc:</b> Daniel-Constantin Mierla <<a href="mailto:miconda@gmail.com" target="_blank">miconda@gmail.com</a>>; <a href="mailto:yufei.tao@gmail.com" target="_blank">yufei.tao@gmail.com</a>; Olle E. Johansson <<a href="mailto:oej@edvina.net" target="_blank">oej@edvina.net</a>>;
Gerry | Rigatta <<a href="mailto:gjacobsen@rigatta.com" target="_blank">gjacobsen@rigatta.com</a>>; Kamailio (SER) - Users Mailing List <<a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a>>; <a href="mailto:jbrower@signalogic.com" target="_blank">jbrower@signalogic.com</a></span><br>
<span class="qt-"><b>Subject:</b> Re: [SR-Users] Kamailio vulnerable to header smuggling possible due to bypass of remove_hf</span></span><o:p></o:p></p>
</div>
</div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB"> </span></span><o:p></o:p></p>
</div>
<div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt">On Wed, Sep 2, 2020 at 11:30 AM Henning Westerholt <<a href="mailto:hw@skalatan.de" target="_blank">hw@skalatan.de</a>> wrote:<o:p></o:p></p>
</div>
</div>
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">Hello Maxim,</span></span><o:p></o:p></p>
</div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB"> </span></span><o:p></o:p></p>
</div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">thank you for the clarification, appreciated.</span></span><o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
</div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt">No worries, hope to have a civilized discussion.<o:p></o:p></p>
</div>
</div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">Just one clarification, my comment regarding the advisory from 2018 was not meant as advertisement etc..</span></span><o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
</div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt">Point taken, I dramatized of course to underline my point. <o:p></o:p></p>
</div>
</div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt">One suggestion to objectify the whole discussion, there exists a well-known and accepted metric for vulnerabilities: CVSS [1]<o:p></o:p></p>
</div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">If I calculate the CVSS score for this issue, it results in a medium level with score 5.8. But this is of course again (at least somewhat) influenced from my point of view
to this bug.</span></span><o:p></o:p></p>
</div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB"> </span></span><o:p></o:p></p>
</div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">Some projects have a policy to only do a security announcement for vulnerabilities with score high and critical. For Kamailio this is not yet defined in a detailed way, due
to the size of the project and other factors.</span></span><o:p></o:p></p>
</div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB"> </span></span><o:p></o:p></p>
</div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">So, If people in this discussion (or other people on the list) are interested in improving the project security processes – this wiki page with the current process might be
a good starting point:<a href="https://www.kamailio.org/wiki/security/policy" target="_blank">https://www.kamailio.org/wiki/security/policy</a></span></span><o:p></o:p></p>
</div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB"> </span></span><o:p></o:p></p>
</div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="qt-"><span lang="EN-GB">Please suggest your improvements to the existing process (preferable in a new discussion thread) on the sr-dev list. If you want to do it in private, feel free contact the
management list.</span></span><o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
</div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt">Well, first suggestion after having read it: to start actually following what's documented before any improvements are made. ;-) The policy says plain and simple (quote):<o:p></o:p></p>
</div>
</div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
</div>
</div>
<blockquote style="margin-left:30.0pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<h4 style="mso-margin-top-alt:5.0pt;margin-right:0cm;margin-bottom:12.0pt;margin-left:70.8pt" id="qt-gmail-m_-221075449414644861gmail-publishing_security_vulnerabilities">
<span class="size"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333">Publishing security vulnerabilities</span></span><o:p></o:p></h4>
</div>
</div>
</blockquote>
<blockquote style="margin-left:30.0pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="size"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333">Kamailio will publish security vulnerabilities, including an CVE ID, on the kamailio-business mailing list, sr-dev,
sr-users as well as related lists.</span></span><span class="qt-"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333"> </span></span><span class="size"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:red">The advisories
will also be published on the</span></span><span class="qt-"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:red"> </span></span><span class="size"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:red"><a href="http://kamailio.org/" target="_blank">kamailio.org</a></span></span><span class="qt-"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:red"> </span></span><span class="size"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:red">web
site</span></span><span class="size"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333">.</span></span> <o:p></o:p></p>
</div>
</div>
</div>
<div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
</div>
</div>
<div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"><span class="size"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#333333">CVE entries should be created for vulnerabilities in the core and major modules, for rarely used modules this is not
necessary. If there are several security issues together in one release, they should be announced together.</span></span> <o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
<div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
</div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt">I might be missing something obvious, but there is no "if" or "maybe" or "it depends". Any module that has been 18 years with the project qualifies to be a "major module" to me... <o:p></o:p></p>
</div>
</div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt"> <o:p></o:p></p>
</div>
</div>
<div>
<div style="margin-left:35.4pt">
<p class="MsoNormal" style="margin-left:35.4pt">-Max<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Kamailio (SER) - Users Mailing List<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><a href="mailto:sr-users@lists.kamailio.org" target="_blank">sr-users@lists.kamailio.org</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users" target="_blank">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><o:p></o:p></p>
</div>
</blockquote>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Kamailio (SER) - Users Mailing List<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><a href="mailto:sr-users@lists.kamailio.org">sr-users@lists.kamailio.org</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">_______________________________________________<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt">Kamailio (SER) - Users Mailing List<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><a href="mailto:sr-users@lists.kamailio.org">sr-users@lists.kamailio.org</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><a href="https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users">https://lists.kamailio.org/cgi-bin/mailman/listinfo/sr-users</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:35.4pt"><o:p> </o:p></p>
</div>
</div>
</body>
</html>