[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 4 Jun 2013 09:51:41 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: libsrtp buffer overflow flaw
A buffer overflow flaw was reported in libsrtp, Cisco's reference
implementation of the Secure Real-time Transport Protocol (SRTP), in how
the crypto_policy_set_from_profile_for_rtp() function applies
cryptographic profiles to an srtp_policy. This could allow for a crash
of a client linked against libsrtp (like asterisk or linphone).
A pull request in git has a patch to correct this issue (doesn't look
like it's been merged into master yet though).
References:
http://seclists.org/fulldisclosure/2013/Jun/10
https://github.com/cisco/libsrtp/pull/26
https://bugzilla.redhat.com/show_bug.cgi?id=970697
As an aside, when I was poking around in github, I also found this but I
don't know anything about libsrtp so I don't know if this is something
that can be triggered by a remote user or if this is just a hardening
thing, but the commit message is "Security fix to not ignore RTCP
encryption, if required."
https://github.com/cisco/libsrtp/commit/8ad50a05279b61a382da3cc730ff1560ab4272e8
Is there someone more familiar with libsrtp that might be able to
comment on whether or not this is a flaw (so can a remote user request
to disable encryption and do ... something?)
--
Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
