Executive brief
SIPp is an open-source test tool and traffic generator used to simulate network traffic for the Session Initiation Protocol (SIP). A security vulnerability in how the tool handles command-line instructions allows a local user to crash the application or potentially execute unauthorized code. This could lead to a loss of system integrity or a disruption in testing operations if an attacker has access to the machine where SIPp is running.
Technical details
A classic buffer overflow (CWE-120) exists in SIPp versions 3.6 and earlier due to the unsafe use of the 'strcpy' function within 'sipp.cpp'. The vulnerability is triggered when the application processes oversized input strings provided via the '-3pcc', '-i', or '-log_file' command-line parameters. Because the application fails to validate the length of these arguments before copying them into fixed-size buffers, a local attacker can overwrite adjacent memory. This can result in a denial-of-service (application crash) or arbitrary code execution with the privileges of the user running SIPp. While the vulnerability was disclosed in 2018, it was formally assigned a CVE in 2026.
Affected products
- SIPp SIPp 3.6 and earlier
Timeline
- 2018-06-30: disclosed: Initial discovery and PoC by Fakhri Zulkifli
- 2018-07-02: other: Exploit-DB entry published
- 2026-05-23: advisory: CVE-2018-25356 published via VulnCheck/NVD