3GPP Phone Log File Parser Denial of Service in 4.6.x and 4.4.x

Executive Summary

This vulnerability is a crash in the 3gpp phone log file parser affecting versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. It allows a denial of service attack by causing the parser to crash when processing certain files.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the 3gpp phone log file parser versions 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18. Detection involves checking the installed version of the parser. Use commands like 'parser --version' or 'dpkg -l | grep 3gpp' to identify the version. If the version falls within the affected range, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can cause system crashes, leading to service disruption. An attacker could exploit this by providing malformed log files to trigger the crash, resulting in denial of service for users relying on the parser.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes a denial of service due to a crash in the 3gpp phone log file parser. It does not directly affect data confidentiality or integrity but may impact system availability. Compliance impact depends on whether the affected system is critical for processing personal or health data under GDPR or HIPAA. Downtime could lead to non-compliance if the system is required for timely data access or processing.

Useful 0 Not Useful 0

Mitigation Strategies

Update the 3gpp phone log file parser to a version outside the affected range (4.6.0 to 4.6.7 and 4.4.0 to 4.4.18).

Useful 0 Not Useful 0