Tags › Security Advisory

rtpengine: denial of service via DTLS Hello packets during call initiation

• Fixed versions: mr12.1.1.2, mr12.0.1.3, mr11.5.1.16, mr10.5.6.3, mr10.5.6.2, mr9.5.8.2, mr8.5.12.2
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2023-03-rtpengine-dtls-hello-race/
• Vendor Patch: https://github.com/sipwise/rtpengine/commit/e969a79428ac4a15cdf1c0a1c6f266dbdc7e60b6
• Other references: CVE-2023-51275
• Tested vulnerable versions: mr11.5.1.6
• Timeline:
  • Report date: 2023-10-02
  • Triaged: 2023-10-02
  • Fix provided for testing: 2023-11-16
  • Enable Security verified fix: 2023-12-14
  • Vendor release with fix: 2023-12-14
  • Enable Security advisory: 2023-12-15

TL;DR

When handling DTLS-SRTP for media setup, RTPEngine is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS encrypted calls during the attack.

Asterisk: denial of service via DTLS Hello packets during call initiation

• Fixed versions: 18.20.1, 20.5.1, 21.0.1,18.9-cert6
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2023-01-asterisk-dtls-hello-race/
• Vendor Security Advisory: https://github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq
• Other references: CVE-2023-49786
• Tested vulnerable versions: 20.1.0
• Timeline:
  • Report date: 2023-09-27
  • Triaged: 2023-09-27
  • Fix provided for testing: 2023-11-09
  • Vendor release with fix: 2023-12-14
  • Enable Security advisory: 2023-12-15

TL;DR

When handling DTLS-SRTP for media setup, Asterisk is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack.

FreeSWITCH: unauthenticated SIP SUBSCRIBE requests by default

• Fixed versions: v1.10.7
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2021-08-freeswitch-SIP-SUBSCRIBE-without-auth/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-g7xg-7c54-rmpj
• Other references: CVE-2021-41157
• Tested vulnerable versions: <= v1.10.5
• Timeline:
  • Report date: 2021-06-07
  • Triaged: 2021-06-08
  • Fix provided for testing: 2021-10-01
  • Vendor release with fix: 2021-10-24
  • Enable Security advisory: 2021-10-25

Description

By default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of FreeSWITCH. Although this issue was fixed in version v1.10.6, installations upgraded to the fixed version of FreeSWITCH from an older version, may still be vulnerable if the configuration is not updated accordingly. For good reason, by default, software upgrades do not update the configuration.

FreeSWITCH: unauthenticated SIP MESSAGE requests allow spam and spoofing

• Fixed versions: v1.10.7
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2021-07-freeswitch-SIP-MESSAGE-without-auth/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-mjcm-q9h8-9xv3
• Other references: CVE-2021-37624
• Tested vulnerable versions: <= v1.10.6
• Timeline:
  • Report date: 2021-06-07
  • Fix provided for testing: 2021-07-27
  • Vendor release with fix: 2021-10-24
  • Enable Security advisory: 2021-10-25

Description

By default, SIP requests of the type MESSAGE (RFC 3428) are not authenticated in the affected versions of FreeSWITCH. MESSAGE requests are relayed to SIP user agents registered with the FreeSWITCH server without requiring any authentication. Although this behaviour can be changed by setting the auth-messages parameter to true, it is not the default setting.

FreeSWITCH: SIP digest leak for configured gateways

• Fixed versions: v1.10.7
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2021-05-freeswitch-vulnerable-to-SIP-digest-leak/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-3v3f-99mv-qvj4
• Other references: CVE-2021-41158
• Tested vulnerable versions: <= v1.10.6
• Timeline:
  • Report date: 2021-04-22
  • Triaged: 2021-04-23
  • Fix provided for testing: 2021-08-13
  • Second fix provided for testing: 2021-09-14
  • Vendor release with fix: 2021-10-24
  • Enable Security advisory: 2021-10-25

Description

An attacker can perform a SIP digest leak attack against FreeSWITCH and receive the challenge response of a gateway configured on the FreeSWITCH server. This is done by challenging FreeSWITCH’s SIP requests with the realm set to that of the gateway, thus forcing FreeSWITCH to respond with the challenge response which is based on the password of that targeted gateway.

FreeSWITCH: denial of service via SIP flooding

• Fixed versions: v1.10.7
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2021-06-freeswitch-flood-dos/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-jvpq-23v4-gp3m
• Other references: CVE-2021-41145
• Tested vulnerable versions: <= v1.10.6
• Timeline:
  • Report date: 2021-05-28
  • Triaged: 2021-06-18
  • Fix provided for testing: 2021-10-08
  • Second fix provided for testing: 2021-10-13
  • Vendor release with fix: 2021-10-24
  • Enable Security advisory: 2021-10-25

Description

When flooding FreeSWITCH with SIP messages, it was observed that after a number of seconds the process was killed by the operating system due to memory exhaustion. The following excerpt from syslog shows one such instance:

FreeSWITCH: denial of service via invalid SRTP packets

• Fixed versions: v1.10.7
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2021-09-freeswitch-srtp-dos/
• Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-jh42-prph-gp36
• Other references: CVE-2021-41105
• Tested vulnerable versions: <= v1.10.6
• Timeline:
  • Report date: 2021-09-06
  • Triaged: 2021-09-10
  • Fix provided for testing: 2021-09-17
  • Vendor release with fix: 2021-10-24
  • Enable Security advisory: 2021-10-25

TL;DR

When handling SRTP calls, FreeSWITCH is susceptible to a DoS where calls can be terminated by remote attackers. This attack can be done continuously, thus denying encrypted calls during the attack.

Description

When a media port that is handling SRTP traffic is flooded with a specially crafted SRTP packet, the call is terminated leading to denial of service. This issue was reproduced when using the SDES key exchange mechanism in a SIP environment as well as when using the DTLS key exchange mechanism in a WebRTC environment.

VoIPmonitor: static builds lack memory corruption protections

• Fixed versions: N/A
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2021-04-voipmonitor-staticbuild-memory-corruption-protection/
• VoIPmonitor Security Advisory: none
• Tested vulnerable versions: 27.5
• Timeline:
  • Report date: 2021-02-10 & 2021-02-13
  • Enable Security advisory: 2021-03-15

Description

The binaries available for download at https://www.voipmonitor.org/download are built without any memory corruption protection in place. The following is output from the tool hardening-check:

hardening-check voipmonitor:
 Position Independent Executable: no, normal executable!
 Stack protected: no, not found!
 Fortify Source functions: unknown, no protectable libc functions used
 Read-only relocations: no, not found!
 Immediate binding: no, not found!
 Stack clash protection: unknown, no -fstack-clash-protection instructions found
 Control flow integrity: unknown, no -fcf-protection instructions found!

When stack protection together with Fortify Source and other protection mechanisms are in place, exploitation of memory corruption vulnerabilities normally results in a program crash instead of leading to remote code execution. Most modern compilation systems create executable binaries with these features built-in by default. When these features are not used, attackers may easily exploit memory corruption vulnerabilities, such as buffer overflows, to run arbitrary code. In this advisory we will demonstrate how a buffer overflow reported in a separate advisory, could be abused to run arbitrary code because of the lack of standard memory corruption protection in the static build releases of VoIPmonitor.

VoIPmonitor: cross-site scripting via SIP messages

• Fixed versions: VoIPmonitor WEB GUI 24.56
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2021-02-voipmonitor-gui-xss/
• VoIPmonitor Security Advisory: none, changelog references fixes at https://www.voipmonitor.org/changelog-gui?major=5
• Tested vulnerable versions: 24.53, 24.54, 24.55
• References: CVE-2021-1000004
• Timeline:
  • Report date: 2021-02-10
  • Triaged: 2021-02-12
  • First fixes available: 2021-02-15
  • Fixes to actually address XSS: 2021-02-22
  • VoIPmonitor release with fix: 2021-02-22
  • Enable Security advisory: 2021-03-15

Description

Multiple Cross-Site Scripting vulnerabilities were observed in the VoIPmonitor WEB GUI. These vulnerabilities can be exploited by sending SIP messages towards hosts monitored by VoIPmonitor. During our tests, the following areas were affected:

VoIPmonitor: buffer overflow in live sniffer

• Fixed versions: 27.6
• Enable Security Advisory: https://www.enablesecurity.com/advisories/ES2021-03-voipmonitor-livesniffer-buffer-overflow/
• VoIPmonitor Security Advisory: none, changelog references fixes at https://www.voipmonitor.org/changelog-sniffer
• Tested vulnerable versions: 27.5
• References: CVE-2021-1000005
• Timeline:
  • Report date: 2021-02-10
  • Triaged: 2021-02-12
  • Fix provided for testing: 2021-02-15
  • VoIPmonitor release with fix: 2021-02-15
  • Enable Security advisory: 2021-03-15

Description

A buffer overflow was identified in the VoIPmonitor live sniffer feature. The description variable in the function save_packet_sql is defined as a fixed length array of 1024 characters. The description is set to the value of a SIP request or response line. By setting a long request or response line VoIPmonitor will trigger a buffer overflow. The affected code is: