Bug#1036847: sofia-sip: CVE-2023-32307: heap-over-flow and integer-overflow in stun_parse_attr_error_code and stun_parse_attr_uint32

[Salvatore Bonaccorso]

Source: sofia-sip
Version: 1.12.11+20110422.1+1e14eea~dfsg-5
Severity: grave
Tags: security upstream
Forwarded: https://github.com/freeswitch/sofia-sip/pull/214
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for sofia-sip.

CVE-2023-32307[0]:
| Sofia-SIP is an open-source SIP User-Agent library, compliant with the
| IETF RFC3261 specification. Referring to [GHSA-8599-x7rq-
| fr54](https://github.com/freeswitch/sofia-
| sip/security/advisories/GHSA-8599-x7rq-fr54), several other potential
| heap-over-flow and integer-overflow in stun_parse_attr_error_code and
| stun_parse_attr_uint32 were found because the lack of attributes
| length check when Sofia-SIP handles STUN packets. The previous patch
| of [GHSA-8599-x7rq-fr54](https://github.com/freeswitch/sofia-
| sip/security/advisories/GHSA-8599-x7rq-fr54) fixed the vulnerability
| when attr_type did not match the enum value, but there are also
| vulnerabilities in the handling of other valid cases. The OOB read and
| integer-overflow made by attacker may lead to crash, high consumption
| of memory or even other more serious consequences. These issue have
| been addressed in version 1.13.15. Users are advised to upgrade.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-32307
    https://www.cve.org/CVERecord?id=CVE-2023-32307
[1] https://github.com/freeswitch/sofia-sip/pull/214
[2] https://github.com/freeswitch/sofia-sip/security/advisories/GHSA-rm4c-ccvf-ff9c
[3] https://github.com/freeswitch/sofia-sip/commit/c3bbc50c88d168065de34ca01b9b1d98c1b0e810

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore