CVE-2024-3120: falha crítica em irontec sngrep
Stack-Buffer Overflow in 'Content-Length' and 'Warning' Header Processing in sngrep
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9epss 1.8%
A stack-buffer overflow vulnerability exists in all versions of sngrep since v1.4.1. The flaw is due to inadequate bounds checking when copying 'Content-Length' and 'Warning' headers into fixed-size buffers in the sip_validate_packet and sip_parse_extra_headers functions within src/sip.c. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via crafted SIP messages.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
irontec · sngrepCVEs relacionadas — irontec sngrep
No mesmo produto, das mais perigosas para as menos.
CVE-2026-121943MEDIUMIrontec sngrep through 1.9.0 Out-of-Bounds Stack Read via sip_check_packetEPSS 5.6%CVE-2024-3119CRITICALStack-Buffer Overflow in 'Call-ID' and 'X-Call-ID' SIP Header Processing in sngrepEPSS 1.8%CVE-2026-90558CRITICALsngrep through 1.8.4 Stack Buffer Overflow via SIP HeadersEPSS 0.9%CVE-2026-121944MEDIUMsngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLVEPSS 0.2%