Just to give proper details about the issue ...
It is not that any 30x response sent by anyone was causing a crash, only those received in a transaction and handled via get_redirects(), with an empty URI in Contact header. That means an authenticated/trusted endpoint has to be involved in such a call. The code causing it is also quite old (might be close to 10 years now).
So there is no risk of being hit by malicious/unknown attackers from the wild.
Cheers, Daniel
On 05/02/15 15:36, Olle E. Johansson wrote:
Friends,
I think today's issue with a 302 message sent to kamailio causing a crash is a security issue. It was dealt with swiftly, but I feel we need a more formal procedure for handling it, producing patches and releasing security information.
I've made a quick proposal that outlines a few simple things and policys. We should make it too complex, but I feel it's important for all our users that a project has some procedure on how to handle situations like this.
Please check the proposal in the dev meeting agenda and let's discuss it in the dev meeting.
http://www.kamailio.org/wiki/devel/irc-meetings/2015a
/O _______________________________________________ sr-dev mailing list sr-dev@lists.sip-router.org http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev