Debian Patches
Status for sngrep/1.8.4-2
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 0001-fix-prevent-stack-buffer-overflow-in-SIP-attribute-f.patch | fix: prevent stack buffer overflow in SIP attribute formatting call_get_attribute() formatted the Call-ID, X-Call-ID and Reason header text with an unbounded sprintf("%s"). Call-ID/X-Call-ID can hold up to MAX_CALLID_SIZE/MAX_XCALLID_SIZE (1023 bytes) and Reason text is copied from the raw payload (up to MAX_SIP_PAYLOAD), while all callers pass a 255-byte SIP_ATTR_MAXLEN stack buffer (call list rendering, sort compare). A SIP message with a long Call-ID, X-Call-ID or Reason header overflowed the stack, triggerable via pcap, live capture or HEP/EEP remote capture. Bound these writes with "%.*s" and SIP_ATTR_MAXLEN - 1. Also fix a matching off-by-one in msg_get_attribute(), where the existing "%.*s" used SIP_ATTR_MAXLEN as the precision and could write 256 bytes (255 chars + NUL) into the 255-byte buffer. Thanks to TristanInSec for reporting the issue. |
Kaian <kaian@irontec.com> | no | 2026-08-07 |
All known versions for source package 'sngrep'
- 1.8.4-2 (sid)
- 1.8.4-1 (forky)
- 1.8.4-1~bpo13+1 (trixie-backports)
- 1.8.2-1 (trixie)
- 1.8.2-1~bpo12+1 (bookworm-backports)
- 1.6.0-1 (bookworm)