#VU17341 Information disclosure in coTURN - CVE-2018-4058
Published: February 1, 2019
Vulnerability identifier: #VU17341
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2018-4058
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
coTURN
coTURN
Software vendor:
coTURN
coTURN
Description
The vulnerability allows a remote authenticated attacker to gain access to potentially sensitive information.
The vulnerability exists in the coturn Traversal Using Relay NAT (TURN) server functionality due to an unsafe default configuration that allows the affected software to enable loopback forwarding to relay external traffic to the loopback interface. A remote attacker can set up a relay with a loopback address as the peer on a targeted TURN server that is designed to forward traffic from an external interface to the server loopback to gain unauthorized access to other sensitive services running on the loopback interface.
Remediation
Update to version 4.5.1.0.