PT-2021-23125 · Unknown+1 · Freeswitch+1

Published 2021-10-25 · Updated 2023-10-08 · CVE-2021-41145

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.10.7

Description The issue concerns a Denial of Service vulnerability via SIP flooding. When FreeSWITCH is flooded with SIP messages, it can lead to memory exhaustion, causing the process to be killed by the operating system. This can be exploited to crash any FreeSWITCH instance, resulting in a Denial of Service. The attack does not require authentication and can be carried out over UDP, TCP, or TLS.

Recommendations For versions prior to 1.10.7, update to version 1.10.7 or later to resolve the issue. As a temporary workaround, consider implementing rate limiting on SIP messages to minimize the risk of exploitation. Restrict access to the SIP interface to trusted sources only. Avoid using the SIP protocol over unsecured connections to reduce the attack surface.

Exploit

Fix

DoS

Memory Leak

Resource Exhaustion

Weakness Enumeration

CWE-401

CWE-400

Related Identifiers

ALT-PU-2021-3374

ALT-PU-2021-3448

ALT-PU-2023-5726

CVE-2021-41145

GHSA-JVPQ-23V4-GP3M

Affected Products

Alt Linux

Freeswitch

References · 10

• 🔥 https://github.com/signalwire/freeswitch/security/advisories/GHSA-jvpq-23v4-gp3m · Exploit
• 🔥 http://seclists.org/fulldisclosure/2021/Oct/42 · Exploit
• https://osv.dev/vulnerability/ALPINE-CVE-2021-41145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41145 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41145 · Vendor Advisory
• https://github.com/signalwire/freeswitch/releases/tag/v1.10.7 · Note
• https://security.alpinelinux.org/vuln/CVE-2021-41145 · Note
• https://t.me/cibsecurity/31184 · Telegram Post
• https://t.me/defcon_news/88262 · Telegram Post
• https://t.me/cvenotify/22394 · Telegram Post