Coturn 4.15.0 Multiple Vulnerabilities Fixed (GHSA-5538-7cxj-5jcc/Buffer Overflow/Info Leak)

Vulnerability Overview Coturn version 4.15.0 addresses multiple security vulnerabilities, primarily including: 1. STUN Attribute Processing Vulnerability: STUN attributes following were being ignored (GHSA-5538-7cxj-5jcc). According to RFC 8489 §9 and RFC 5389 §15.4, attributes following (except for ) should be ignored; however, Coturn processed the entire attribute list. Additionally, a mutual exclusion error was fixed where erroneously responded with error 420 when an RFC 8489 client sent . 2. Binding Mobility Session Recovery Vulnerability: Mobility session recovery was bound to the original allocation owner (#1969), ensuring that MOBILITY-TICKET recovery is only accepted from the user who created the allocation. 3. ACME Request Rejection Vulnerability: ACME requests are now explicitly rejected via a signed 400 response (#1965) instead of being silently discarded. 4. UDP Receive Buffer Offset Reset Vulnerability: The offset of reused UDP receive buffers in the DTLS listener is now correctly reset (#1986). 5. Uninitialized Stack Bytes Null-Padding Vulnerability: Channel data padding is null-padded in to prevent uninitialized stack bytes from reaching the network (#1984). 6. uint16_t Truncation Overflow Vulnerability: Fixed truncation overflow when calculating STUN message length (#1964). 7. Realm Buffer Out-of-Bounds Write Vulnerability: Fixed out-of-bounds writes to the realm buffer in (#1978). 8. Teletext Data Overflow Vulnerability: Fixed underflow in (#1980) and overflow when parsing MSSP subnet specifications to the end of the buffer (#1972). 9. HTTP Request Buffer Null-Termination Vulnerability: Changed in to be NULL-terminated before logging the raw HTTP request (#1966). Impact Scope STUN Attribute Processing Vulnerability: Affects all STUN servers using Coturn, potentially leading to security bypasses. Binding Mobility Session Recovery Vulnerability: Affects users utilizing the MOBILITY-TICKET recovery feature. ACME Request Rejection Vulnerability: Affects users of the ACME protocol. UDP Receive Buffer Offset Reset Vulnerability: Affects the performance of DTLS listeners. Uninitialized Stack Bytes Null-Padding Vulnerability: May lead to information disclosure. uint16_t Truncation Overflow Vulnerability: May cause incorrect message length calculations. Realm Buffer Out-of-Bounds Write Vulnerability: May lead to memory corruption. Teletext Data Overflow Vulnerability: May cause data corruption or crashes. HTTP Request Buffer Null-Termination Vulnerability: May lead to logging errors. Remediation STUN Attribute Processing Vulnerability: Adhere to RFC specifications and correctly handle attributes following . Binding Mobility Session Recovery Vulnerability: Ensure MOBILITY-TICKET recovery is accepted only from the user who created the allocation. ACME Request Rejection Vulnerability: Reject ACME requests via signed 400 responses. UDP Receive Buffer Offset Reset Vulnerability: Reset the offset of reused UDP receive buffers in the DTLS listener. Uninitialized Stack Bytes Null-Padding Vulnerability: Null-pad channel data padding in . uint16_t Truncation Overflow Vulnerability: Fix truncation overflow. Realm Buffer Out-of-Bounds Write Vulnerability: Fix out-of-bounds writes to the realm buffer in . Teletext Data Overflow Vulnerability: Fix underflow in and overflow during MSSP subnet specification parsing to the end of the buffer. HTTP Request Buffer Null-Termination Vulnerability: Ensure in is NULL-terminated. POC Code or Exploit Code No specific POC code or exploit code is provided in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Coturn 4.15.0 Multiple Vulnerabilities Fixed (GHSA-5538-7cxj-5jcc/Buffer Overflow/Info Leak)

More from this source