Tags › CVE-2021-41158

FreeSWITCH: SIP digest leak for configured gateways

• Fixed versions: v1.10.7
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2021-05-freeswitch-vulnerable-to-SIP-digest-leak/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-3v3f-99mv-qvj4
• Other references: CVE-2021-41158
• Tested vulnerable versions: <= v1.10.6
• Timeline:
  • Report date: 2021-04-22
  • Triaged: 2021-04-23
  • Fix provided for testing: 2021-08-13
  • Second fix provided for testing: 2021-09-14
  • Vendor release with fix: 2021-10-24
  • Enable Security advisory: 2021-10-25

Description

An attacker can perform a SIP digest leak attack against FreeSWITCH and receive the challenge response of a gateway configured on the FreeSWITCH server. This is done by challenging FreeSWITCH’s SIP requests with the realm set to that of the gateway, thus forcing FreeSWITCH to respond with the challenge response which is based on the password of that targeted gateway.