PT-2014-1883 · Cisco+2 · Libsrtp+2

Jfigus · Published 2014-01-16 · Updated 2024-06-15 · CVE-2013-2139

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions libsrtp versions prior to 1.4.4 p20121108-r1 libsrtp version 1.4.5 and earlier

Description The issue is related to a buffer overflow in the srtp.c file of the libsrtp package, which can be exploited remotely to cause a denial of service (crash). This is due to a length inconsistency in the crypto policy set from profile for rtp and srtp protect functions.

Recommendations For libsrtp versions prior to 1.4.4 p20121108-r1, update to version 1.4.4 p20121108-r1 or later. For libsrtp version 1.4.5 and earlier, update to a version later than 1.4.5. As a temporary workaround, consider restricting access to the srtp protect and crypto policy set from profile for rtp functions until a patch is available.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-09736

CESA-2020_3873

CVE-2013-2139

DSA-2840-1

MGASA-2014-0465

OPENSUSE-SU-2024:10265-1

OPENSUSE-SU-2024:10997-1

RHSA-2020:3873

RHSA-2020_3873

Affected Products

Centos

Red Hat

Libsrtp

References · 22

• https://osv.dev/vulnerability/openSUSE-SU-2024:10265-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2014-09/msg00059.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2014:219 · Vendor Advisory
• https://debian.org/security/2014/dsa-2840 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10997-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0465 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3873.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09736 · Security Note
• https://advisories.mageia.org/MGASA-2014-0465.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-2139 · Security Note
• http://lists.opensuse.org/opensuse-updates/2013-07/msg00083.html · Vendor Advisory
• http://lwn.net/Articles/579633 · Vendor Advisory
• http://debian.org/security/2014/dsa-2840 · Vendor Advisory
• https://github.com/cisco/libsrtp/pull/27 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=970697 · Note