Use of Uninitialized Variable in pjsip - #VU159276

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service and potentially disclose sensitive memory contents.

The vulnerability exists due to use of uninitialised format entries in the SDP negotiator's match_offer() function in pjmedia/src/pjmedia/sdp_neg.c when processing an offer that repeats a media format. A remote attacker can send a single INVITE containing duplicate formats to produce excess answer entries, triggering an assertion failure in assertion-enabled builds or reads of uninitialised memory in release builds that can crash the application or expose stale memory contents in the SDP answer.

Applications must have text media with redundancy (RED) enabled; this is the default in pjsua-lib and PJSUA2.

Affected software

Remediation

External References

• https://github.com/pjsip/pjproject/security/advisories/GHSA-966q-2r4w-549m

Related Security Bulletins

• Multiple vulnerabilities in pjsip