PT-2019-1902 · Coturn · Coturn

Publicado 2019-01-28 · Atualizado 2022-06-07 · CVE-2018-4058

Positive Technologies (AI Summary)

CVSS v3.1

7.7

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions coTURN versions prior to 4.5.0.9

Description The issue is related to an unsafe default configuration in the coTURN server, which allows the relaying of external traffic to the loopback interface of its own host. This can provide access to other private services running on that host, potentially leading to further attacks. An attacker can exploit this by setting up a relay with a loopback address as the peer on an affected TURN server.

Recommendations For coTURN versions prior to 4.5.0.9, update to version 4.5.0.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the TURN server functionality to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-16

Identificadores relacionados

BDU:2019-01560

CVE-2018-4058

DLA-1671-1

DSA-4373-1

Produtos afetados

Coturn

Referências · 13

• https://ubuntu.com/security/CVE-2018-4058 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-4058 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-4058 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-4058 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-4058 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2018-4058 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-4058 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4373-1 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01560 · Nota de Segurança
• https://talosintelligence.com/vulnerability_reports/TALOS-2018-0732 · Nota
• https://osv.dev/vulnerability/DLA-1671-1 · Aviso do Fabricante
• https://rapid7.com/db/vulnerabilities/debian-cve-2018-4058 · Nota
• https://debian.org/security/2019/dsa-4373 · Aviso do Fabricante