PT-2024-20329 · Unknown · Mediaserver

Published 2024-02-05 · Updated 2024-08-26 · CVE-2024-24260

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions media-server version 1.0.0

Description The issue is related to a Use-After-Free (UAF) vulnerability. This vulnerability occurs when the sip subscribe remove function is used. The UAF vulnerability is a type of memory corruption bug that can cause a program to access memory after it has been freed, potentially leading to crashes or code execution.

Recommendations For media-server version 1.0.0, as a temporary workaround, consider disabling the sip subscribe remove function until a patch is available. Restrict access to the /uac/sip-uac-subscribe.c module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2024-24260

Affected Products

Mediaserver

References · 7

• 🔥 https://github.com/yinluming13579/media-server_defects/blob/main/media-server_1.md · Exploit
• https://osv.dev/vulnerability/CVE-2024-24260 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-24260 · Security Note
• https://t.me/cvenotify/70515 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1754589628491788477 · Twitter Post
• https://t.me/cvenotify/92218 · Telegram Post
• https://twitter.com/CVEnew/status/1754563644237426925 · Twitter Post