| Summary: | <net-libs/libsrtp-1.4.4_p20121108-r1 : Buffer overflow in application of crypto profiles (CVE-2013-2139) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | chainsaw, chromium, voip+disabled |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://bugzilla.redhat.com/show_bug.cgi?id=970697 | ||
| Whiteboard: | B3 [glsa] | ||
| Package list: | Runtime testing required: | --- | |
(In reply to Agostino Sarubbo from comment #0) > A pull request in git [2] has a patch to correct this issue. > > [1] http://seclists.org/fulldisclosure/2013/Jun/10 > [2] https://github.com/cisco/libsrtp/pull/26 The pull request author wrote "The changes to the rtcp code are not correct. I'll fix this tomorrow and send a new pull request." Fixed in the next pull request: https://github.com/cisco/libsrtp/pull/27 Arches, please test and stabilize libsrtp-1.4.4_p20121108-r1 amd64 stable x86 stable @creffett: why B3 instead of B2? ppc stable alpha/ia64 stable ppc64 stable vote please Thanks for your work. GLSA vote: yes CVE-2013-2139 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-2139): Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions. GLSA vote: yes. glsa request filed. This issue was resolved and addressed in GLSA 201405-02 at http://security.gentoo.org/glsa/glsa-201405-02.xml by GLSA coordinator Sean Amoss (ackle). |
From ${URL} : A buffer overflow flaw was reported [1] in libsrtp, Cisco's reference implementation of the Secure Real-time Transport Protocol (SRTP), in how the crypto_policy_set_from_profile_for_rtp() function applies cryptographic profiles to an srtp_policy. This could allow for a crash of a client linked against libsrtp (like asterisk or linphone). A pull request in git [2] has a patch to correct this issue. [1] http://seclists.org/fulldisclosure/2013/Jun/10 [2] https://github.com/cisco/libsrtp/pull/26 @maintainer(s): after the bump, in case we need to stabilize the package, please say explicitly if it is ready for the stabilization or not.