Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 4 Jun 2013 09:51:41 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: libsrtp buffer overflow flaw

A buffer overflow flaw was reported in libsrtp, Cisco's reference
implementation of the Secure Real-time Transport Protocol (SRTP), in how
the crypto_policy_set_from_profile_for_rtp() function applies
cryptographic profiles to an srtp_policy.  This could allow for a crash
of a client linked against libsrtp (like asterisk or linphone).

A pull request in git has a patch to correct this issue (doesn't look
like it's been merged into master yet though).

References:

http://seclists.org/fulldisclosure/2013/Jun/10
https://github.com/cisco/libsrtp/pull/26
https://bugzilla.redhat.com/show_bug.cgi?id=970697


As an aside, when I was poking around in github, I also found this but I
don't know anything about libsrtp so I don't know if this is something
that can be triggered by a remote user or if this is just a hardening
thing, but the commit message is "Security fix to not ignore RTCP
encryption, if required."

https://github.com/cisco/libsrtp/commit/8ad50a05279b61a382da3cc730ff1560ab4272e8

Is there someone more familiar with libsrtp that might be able to
comment on whether or not this is a flaw (so can a remote user request
to disable encryption and do ... something?)

-- 
Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.