SB2020062913 - Improper Initialization in coTURN coTURN
Published: June 29, 2020 Updated: July 17, 2020
Security Bulletin ID
SB2020062913
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper Initialization (CVE-ID: CVE-2020-4067)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.
Remediation
Install update from vendor's website.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00010.html
- https://github.com/coturn/coturn/blob/aab60340b201d55c007bcdc853230f47aa2dfdf1/ChangeLog#L15
- https://github.com/coturn/coturn/issues/583
- https://github.com/coturn/coturn/security/advisories/GHSA-c8r8-8vp5-6gcm
- https://lists.debian.org/debian-lts-announce/2020/07/msg00002.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5G35UBNSRLL6SYRTODYTMBJ65TLQILUM/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNJJO77ZLGGFJWNUGP6VDG5HPAC5UDBK/
- https://usn.ubuntu.com/4415-1/
- https://www.debian.org/security/2020/dsa-4711