Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-3873 advisory.

    [1.4.4-11.20101004cvs]
    - Fix global buffer overflow       Resolves: bz#1301202

    - Fix improper handling of CSRC count and extension header length in RTP header       Resolves: bz#1323705

    - Fix buffer overflow in application of crypto profiles       Resolves: bz#1141897

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has libsrtp packages installed that are affected by multiple vulnerabilities:

  - Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial     of service (crash) via vectors related to a length inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect functions. (CVE-2013-2139)

  - The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial     of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. (CVE-2015-6360)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has libsrtp packages installed that are affected by multiple vulnerabilities:

  - The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial     of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. (CVE-2015-6360)

  - Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial     of service (crash) via vectors related to a length inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect functions. (CVE-2013-2139)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3873 advisory.

    The libsrtp package provides an implementation of the Secure Real-time Transport Protocol (SRTP), the     Universal Security Transform (UST), and a supporting cryptographic kernel.

    Security Fix(es):

    * libsrtp: improper handling of CSRC count and extension header length in RTP header (CVE-2015-6360)

    * libsrtp: buffer overflow in application of crypto profiles (CVE-2013-2139)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of libsrtp installed on the remote host is prior to 1.4.4-11.20101004cvs. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1530 advisory.

    Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial     of service (crash) via vectors related to a length inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect functions. (CVE-2013-2139)

    The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial     of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. (CVE-2015-6360)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - libsrtp: improper handling of CSRC count and extension     header length in RTP header (CVE-2015-6360)

  - libsrtp: buffer overflow in application of crypto     profiles (CVE-2013-2139)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3873 advisory.

  - Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and earlier allows remote attackers to cause a denial     of service (crash) via vectors related to a length inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect functions. (CVE-2013-2139)

  - The encryption-processing feature in Cisco libSRTP before 1.5.3 allows remote attackers to cause a denial     of service via crafted fields in SRTP packets, aka Bug ID CSCux00686. (CVE-2015-6360)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the version of the libsrtp package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and     earlier allows remote attackers to cause a denial of     service (crash) via vectors related to a length     inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect     functions.(CVE-2013-2139)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the libsrtp package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and     earlier allows remote attackers to cause a denial of     service (crash) via vectors related to a length     inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect     functions.(CVE-2013-2139)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the libsrtp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Buffer overflow in srtp.c in libsrtp in srtp 1.4.5 and     earlier allows remote attackers to cause a denial of     service (crash) via vectors related to a length     inconsistency in the     crypto_policy_set_from_profile_for_rtp and srtp_protect     functions.(CVE-2013-2139)

  - The encryption-processing feature in Cisco libSRTP     before 1.5.3 allows remote attackers to cause a denial     of service via crafted fields in SRTP packets, aka Bug     ID CSCux00686.(CVE-2015-6360)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated srtp package fixes security vulnerability :

Fernando Russ from Groundworks Technologies reported a buffer overflow flaw in srtp, Cisco's reference implementation of the Secure Real-time Transport Protocol (SRTP), in how the crypto_policy_set_from_profile_for_rtp() function applies cryptographic profiles to an srtp_policy. A remote attacker could exploit this vulnerability to crash an application linked against libsrtp, resulting in a denial of service (CVE-2013-2139).

srtp was updated to fix a buffer overflow flaw that allowed remote attackers to cause a denial of service (crash) via vectors related to a length inconsistency in the crypto_policy_set_from_profile_for_rtp and srtp_protect functions. (CVE-2013-2139).

A buffer overflow in srtp was fixed which could potentially be used by attackers to crash srtp using applications and potentially execute code (CVE-2013-2139, bnc828009).

The remote host is affected by the vulnerability described in GLSA-201405-02 (libSRTP: Denial of Service)

    A flaw was found in how the crypto_policy_set_from_profile_for_rtp()       function applies cryptographic profiles to an srtp_policy in libSRTP.
  Impact :

    A remote attacker could exploit this vulnerability to crash an       application linked against libSRTP, resulting in Denial of Service.
  Workaround :

    There is no known workaround at this time.

Fernando Russ from Groundworks Technologies reported a buffer overflow flaw in srtp, Cisco's reference implementation of the Secure Real-time Transport Protocol (SRTP), in how the crypto_policy_set_from_profile_for_rtp() function applies cryptographic profiles to an srtp_policy. A remote attacker could exploit this vulnerability to crash an application linked against libsrtp, resulting in a denial of service.

Fix CVE-2013-2139 - buffer overflow in application of crypto profiles

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180984	Oracle Linux 7 : libsrtp (ELSA-2020-3873)	Nessus	Oracle Linux Local Security Checks	high
154579	NewStart CGSL CORE 5.05 / MAIN 5.05 : libsrtp Multiple Vulnerabilities (NS-SA-2021-0150)	Nessus	NewStart CGSL Local Security Checks	high
147369	NewStart CGSL CORE 5.04 / MAIN 5.04 : libsrtp Multiple Vulnerabilities (NS-SA-2021-0032)	Nessus	NewStart CGSL Local Security Checks	high
143088	RHEL 7 : libsrtp (RHSA-2020:3873)	Nessus	Red Hat Local Security Checks	high
141941	Amazon Linux 2 : libsrtp (ALAS-2020-1530)	Nessus	Amazon Linux Local Security Checks	high
141738	Scientific Linux Security Update : libsrtp on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	high
141630	CentOS 7 : libsrtp (RHSA-2020:3873)	Nessus	CentOS Local Security Checks	high
138006	EulerOS Virtualization 3.0.6.0 : libsrtp (EulerOS-SA-2020-1787)	Nessus	Huawei Local Security Checks	low
132373	EulerOS 2.0 SP5 : libsrtp (EulerOS-SA-2019-2706)	Nessus	Huawei Local Security Checks	low
132152	EulerOS 2.0 SP3 : libsrtp (EulerOS-SA-2019-2617)	Nessus	Huawei Local Security Checks	high
131625	EulerOS 2.0 SP2 : libsrtp (EulerOS-SA-2019-2472)	Nessus	Huawei Local Security Checks	high
79406	Mandriva Linux Security Advisory : srtp (MDVSA-2014:219)	Nessus	Mandriva Local Security Checks	low
78020	openSUSE Security Update : srtp (openSUSE-SU-2014:1250-1)	Nessus	SuSE Local Security Checks	low
75098	openSUSE Security Update : srtp (openSUSE-SU-2013:1258-1)	Nessus	SuSE Local Security Checks	low
73858	GLSA-201405-02 : libSRTP: Denial of Service	Nessus	Gentoo Local Security Checks	low
71902	Debian DSA-2840-1 : srtp - buffer overflow	Nessus	Debian Local Security Checks	low
71873	Fedora 18 : libsrtp-1.4.4-9.20101004cvs.fc18 (2013-24155)	Nessus	Fedora Local Security Checks	low
71872	Fedora 20 : libsrtp-1.4.4-9.20101004cvs.fc20 (2013-24153)	Nessus	Fedora Local Security Checks	low
71869	Fedora 19 : libsrtp-1.4.4-9.20101004cvs.fc19 (2013-24114)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2013-2139

high

Tenable Plugins

high

high

high

high

high

high

high

low

low

high

high

low

low

low

low

low

low

low

low