Prevent potential DoS attack due to lack of bounds checking on RTP header CSRC count and extension header length. Credit goes to Randell Jesup and the Firefox team for reporting this issue.

(As there is no aead mode available in the Squeeze version, only srtp_unprotect() needed to be patched)

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Cisco Adaptive Security Appliance (ASA) is missing vendor-supplied security patches, and it is configured to use the Phone Proxy feature. It is, therefore, affected by an integer underflow condition in the Secure Real-Time Transport Protocol (SRTP) library due to improper validation of certain fields of SRTP packets.
An unauthenticated, remote attacker can exploit this, via specially crafted SRTP packets, to cause packet decryption to fail, resulting in a denial of service condition.

According to the versions of the libsrtp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and     earlier allows remote attackers to cause a denial of     service (crash) via vectors related to a length     inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect     functions.(CVE-2013-2139)

  - The encryption-processing feature in Cisco libSRTP     before 1.5.3 allows remote attackers to cause a denial     of service via crafted fields in SRTP packets, aka Bug     ID CSCux00686.(CVE-2015-6360)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - libsrtp: improper handling of CSRC count and extension     header length in RTP header (CVE-2015-6360)

  - libsrtp: buffer overflow in application of crypto     profiles (CVE-2013-2139)

The version of libsrtp installed on the remote host is prior to 1.4.4-11.20101004cvs. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1530 advisory.

    Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial     of service (crash) via vectors related to a length inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect functions. (CVE-2013-2139)

    The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial     of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. (CVE-2015-6360)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Randell Jesup and the Firefox team discovered that srtp, Cisco's reference implementation of the Secure Real-time Transport Protocol (SRTP), does not properly handle RTP header CSRC count and extension header length. A remote attacker can exploit this vulnerability to crash an application linked against libsrtp, resulting in a denial of service.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3873 advisory.

    [1.4.4-11.20101004cvs]
    - Fix global buffer overflow       Resolves: bz#1301202

    - Fix improper handling of CSRC count and extension header length in RTP header       Resolves: bz#1323705

    - Fix buffer overflow in application of crypto profiles       Resolves: bz#1141897

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libsrtp packages installed that are affected by multiple vulnerabilities:

  - The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial     of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. (CVE-2015-6360)

  - Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial     of service (crash) via vectors related to a length inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect functions. (CVE-2013-2139)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Cisco IOS XE device is missing vendor-supplied security patches, and it is configured to use the Cisco Unified Border Element (CUBE) or Session Border Controller (SBC) features. It is, therefore, affected by an integer underflow condition in the Secure Real-Time Transport Protocol (SRTP) library due to improper validation of certain fields of SRTP packets. An unauthenticated, remote attacker can exploit this, via specially crafted SRTP packets, to cause packet decryption to fail, resulting in a denial of service condition.

This update for libsrtp fixes the following issues :

  - Update to 1.5.4 :

  - Use BE byte ordering of RTCP trailer.

  - Allow zero length payload on unprotect.

  - Update to new upstream release 1.5.3

  - Maintenance release, including fix for CVE-2015-6360     boo#957376

The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial of service via crafted fields in SRTP packets.

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3873 advisory.

  - Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial     of service (crash) via vectors related to a length inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect functions. (CVE-2013-2139)

  - The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial     of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. (CVE-2015-6360)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libsrtp packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial     of service (crash) via vectors related to a length inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect functions. (CVE-2013-2139)

  - The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial     of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. (CVE-2015-6360)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
87977	Debian DLA-393-1 : srtp security update	Nessus	Debian Local Security Checks	2016/1/19	2021/1/11	high
91759	Cisco ASA libsrtp DoS (CSCux00686)	Nessus	CISCO	2016/6/22	2019/11/19	high
132152	EulerOS 2.0 SP3 : libsrtp (EulerOS-SA-2019-2617)	Nessus	Huawei Local Security Checks	2019/12/18	2024/4/3	high
141738	Scientific Linux Security Update : libsrtp on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	2020/10/21	2024/2/14	high
141941	Amazon Linux 2 : libsrtp (ALAS-2020-1530)	Nessus	Amazon Linux Local Security Checks	2020/10/27	2024/12/11	high
90322	Debian DSA-3539-1 : srtp - security update	Nessus	Debian Local Security Checks	2016/4/5	2021/1/11	high
180984	Oracle Linux 7 : libsrtp (ELSA-2020-3873)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/23	high
147369	NewStart CGSL CORE 5.04 / MAIN 5.04 : libsrtp Multiple Vulnerabilities (NS-SA-2021-0032)	Nessus	NewStart CGSL Local Security Checks	2021/3/10	2021/3/11	high
91760	Cisco IOS XE libsrtp DoS (CSCux04317)	Nessus	CISCO	2016/6/22	2024/5/3	high
93391	openSUSE Security Update : libsrtp (openSUSE-2016-1063)	Nessus	SuSE Local Security Checks	2016/9/9	2026/1/27	high
131625	EulerOS 2.0 SP2 : libsrtp (EulerOS-SA-2019-2472)	Nessus	Huawei Local Security Checks	2019/12/4	2024/4/8	high
130015	Cisco Unity Connection libSRTP Denial of Service Vulnerability	Nessus	CISCO	2019/10/18	2019/10/18	high
141630	CentOS 7 : libsrtp (RHSA-2020:3873)	Nessus	CentOS Local Security Checks	2020/10/20	2024/10/9	high
154579	NewStart CGSL CORE 5.05 / MAIN 5.05 : libsrtp Multiple Vulnerabilities (NS-SA-2021-0150)	Nessus	NewStart CGSL Local Security Checks	2021/10/27	2021/10/27	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high