[sr-dev] Security vulnerability handling

[Daniel-Constantin Mierla]

Just to give proper details about the issue ...

It is not that any 30x response sent by anyone was causing a crash, only
those received in a transaction and handled via get_redirects(), with an
empty URI in Contact header. That means an authenticated/trusted
endpoint has to be involved in such a call. The code causing it is also
quite old (might be close to 10 years now).

So there is no risk of being hit by malicious/unknown attackers from the
wild.


Cheers,
Daniel

On 05/02/15 15:36, Olle E. Johansson wrote:
> Friends,
>
> I think today's issue with a 302 message sent to kamailio causing a crash is a security issue. It was dealt with swiftly, but I feel we need a more formal procedure for handling it, producing patches and releasing security information.
>
> I've made a quick proposal that outlines a few simple things and policys. We should make it too complex, but I feel it's important for all our users that a project has some procedure on how to handle situations like this.
>
> Please check the proposal in the dev meeting agenda and let's discuss it in the dev meeting.
>
> http://www.kamailio.org/wiki/devel/irc-meetings/2015a
>
> /O
> _______________________________________________
> sr-dev mailing list
> sr-dev at lists.sip-router.org
> http://lists.sip-router.org/cgi-bin/mailman/listinfo/sr-dev

-- 
Daniel-Constantin Mierla
http://twitter.com/#!/miconda - http://www.linkedin.com/in/miconda
Kamailio World Conference, May 27-29, 2015
Berlin, Germany - http://www.kamailioworld.com