Sip - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/sip/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 12 Sep 2026 19:21:24 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgStack-based Buffer Overflow in sngrep SIP Parsinghttps://feed.craftedsignal.io/briefs/2026-09-sngrep-buffer-overflow/Sat, 12 Sep 2026 19:21:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-sngrep-buffer-overflow/sngrep versions up to 1.8.4 are vulnerable to a stack-based buffer overflow in SIP header formatting routines, allowing attackers to trigger crashes or achieve remote code execution via malformed SIP packets.sngrep versions 1.8.4 and earlier contain a critical stack-based buffer overflow vulnerability (CVE-2026-90558) within its SIP attribute formatting routines. The vulnerability arises from inadequate boundary checks when parsing SIP headers, such as Call-ID or X-Call-ID, which are constrained to a 255-byte stack buffer. When an attacker sends a specially crafted SIP packet containing header values exceeding this limit, the application memory is corrupted during the rendering process. This flaw enables attackers to force a process crash, leading to a denial-of-service, or potentially overwrite return addresses to execute arbitrary code with the privileges of the sngrep process. Given that sngrep is frequently used in network monitoring environments to capture and analyze VoIP traffic, successful exploitation could facilitate remote code execution on sensitive network management infrastructure.

Impact

Successful exploitation of this vulnerability allows for remote code execution or application crashes. This impacts network security and VoIP service providers utilizing sngrep for traffic analysis. If an attacker gains code execution, they could achieve persistence within the monitoring node, sniff additional traffic, or pivot into other network segments where the monitoring node is located.

Recommendation

Prioritize the update of all sngrep installations to a version beyond 1.8.4 that includes the fix for CVE-2026-90558. Implement network-level ingress filtering to prevent unauthorized SIP traffic from reaching network monitoring infrastructure that is not intended to be exposed to external actors.

]]>criticaladvisoryvulnerabilityrcesipnetworking