Out-of-Bounds Read in libosmo-sigtran M3UA NOTIFY Decoder

Executive Summary

This vulnerability is an out-of-bounds read in the M3UA NOTIFY decoder in libosmo-sigtran through version 2.2.1. It occurs when processing the NOTIFY INFO String Information Element during reception. The issue arises because the string may not end with a null terminator, potentially allowing a remote attacker to read beyond allocated memory and obtain sensitive information.

Useful 0 Not Useful 0

Impact Analysis

A remote attacker could exploit this vulnerability to read sensitive information from memory, potentially leading to data leaks or unauthorized access to system information. This could affect confidentiality and integrity of communications relying on the libosmo-sigtran library.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected versions may face legal and regulatory penalties due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update libosmo-sigtran to version 2.2.1 or later to address the out-of-bounds read vulnerability in the M3UA NOTIFY decoder.

Useful 0 Not Useful 0