Re: [sr-dev] Security announcement related to Kamailio

Am Montag, 19. März 2018, 09:49:55 CET schrieb Henning Westerholt: Hello, I'd like to add a few clarifications and also a configuration workaround for people that for some reasons can't update timely. The issues were fixed before the 4.4.7, 5.0.6, and 5.1.2 releases (on Feb 5 the lcr and Feb 10 the tmx fix) in the respective stable branches. So if you are already running the 4.4.7, 5.0.6 or 5.1.2 release then you have already the fixes deployed. If you don't use the tmx or lcr module, you are of course also save. You'll find all information about this issue consolidated on our web page at: https://www.kamailio.org/w/2018/03/kamailio-security-announcement-tmx-lcr/ Details for the configuration workarounds: For tmx, a length check can be added before checking for re-transmissions (or at the beginning of request_route): if($(ci{s.len) + $(hdr(CSeq){s.len}) + $(ft{s.len}) + $(sel(v.branch){s.len)) sl_send_reply("500", "Not accepted"); exit; } For lcr, the check should be on dialed number ($rU - r-uri username). The issue is exposed if the length of new request URI after lcr operations is over 256 (load_gws()+next_gw() -- with strip and prefix operations, new host, port, params). However, only $rU is used from incoming message, the rest of the attributes are taken from lcr database tables. A good check could be a max 32 length for $rU (this is supposed to be a telephone number, so it is a decent upper limit). If exceeding, the call should be rejected: if($(rU{s.len) > 32) { sl_send_reply("500", "Not accepted"); exit; } Based on common usage out there, usual host names, port and parameters length should exceed 256. But if someone is having long values for those fields, they should double check if the limit is exceeded. This check should be done before use of load_gws(). Best regards, Henning Westerholt Kamailio Project