A stack buffer overflow vulnerability in SIPp versions 3.7.7 and earlier allows an unauthenticated remote attacker to cause a denial of service via a crafted SIP authentication challenge.

This is a stack-based buffer overflow (CWE-121) occurring in the createAuthHeader() function. The vulnerability is triggered when the application processes a malicious SIP 401 or 407 authentication challenge containing oversized algorithm parameters, which can be sent by an unauthenticated attacker to corrupt the stack and terminate the client process.

The primary business impact of this vulnerability is the potential for service disruption, as a successful exploit will cause the SIPp client process to crash. While the vulnerability currently results in a denial of service, stack-based buffer overflows can sometimes be leveraged for arbitrary code execution depending on the execution environment. The CVSS score of 7.5 reflects the high impact on availability and the low complexity required for an attacker to trigger the flaw remotely.

Immediate Action: There is currently no official patch available; users should monitor the official SIPp GitHub repository for security updates and apply them as soon as they are released.

Proactive Monitoring: Security teams should monitor SIPp logs for repeated authentication failures or abnormal traffic patterns involving large algorithm parameters in SIP headers.

Compensating Controls: Deploy network-level traffic inspection or a Session Border Controller (SBC) to validate and sanitize incoming SIP messages, dropping packets that contain malformed or excessively long authentication headers before they reach the SIPp client.

Public Exploit Available: Unknown

This vulnerability presents a significant risk to the stability of SIPp-based testing and signaling infrastructure. Given the lack of an immediate patch, administrators must prioritize the implementation of compensating controls, such as traffic filtering or input validation at the network perimeter, to prevent malformed packets from reaching the application. Once a vendor fix is released, upgrading to the patched version should be treated as a high-priority maintenance task.