Signature Detail

SIP: ReSIProcate VoIP Overflow

This signature detects attempts to exploit a known vulnerability in ReSIProcate SIP stack. Sending an overly long INVITE or OPTIONS request to a VoIP gateway running ReSIProcate can cause either a denial of service (DoS) or can allow an attacker to take control of the gateway with the priviledges of the gateway process. Patches are available. This signature can trigger on non-malicious sessions from devices that send extra data. Use this signature only if you have a VoIP gateway running ReSIProcate installed in your network.

References

• URL: http://labs.mudynamics.com/advisories/MU-200807-01.txt
• URL: https://www.resiprocate.org/ReSIProcate_1.3.3_Release