osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c.

Summary

osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.

Remediation

1. Inventory every Unknown product deployment, including staging.
2. No fixed version appears in the public sources yet. Check the references below and the vendor directly.

References

• Referencehttps://github.com/osmocom/osmo-msc/commit/cd347bbe5392d8170ab87140b2bfdac683058b09
• Referencehttps://osmocom.org/issues/7058