Multiple stack-based buffer overflows in GNU ZRTPCPP before 3.2.0 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ZRTP Hello packet to the (1) ZRtp::findBestSASType, (2) ZRtp::findBestAuthLen, (3) ZRtp::findBestCipher, (4) ZRtp::findBestHash, or (5) ZRtp::findBestPubKey functions.

libzrtpcpp was updated to fix multiple security issues.

The remote host is affected by the vulnerability described in GLSA-201309-13 (GNU ZRTP: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in GNU ZRTP. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

Fixes CVE-2013-2221, CVE-2013-2222, CVE-2013-2223.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to new upstream 2.3.4 to fix several security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mark Dowd reports :

Vulnerability 1. Remote Heap Overflow: If an attacker sends a packet larger than 1024 bytes that gets stored temporarily (which occurs many times - such as when sending a ZRTP Hello packet), a heap overflow will occur, leading to potential arbitrary code execution on the vulnerable host.

Vulnerability 2. Multiple Stack Overflows: ZRTPCPP contains multiple stack overflows that arise when preparing a response to a client's ZRTP Hello packet.

Vulnerability 3. Information Leaking / Out of Bounds Reads : The ZRTPCPP library performs very little validation regarding the expected size of a packet versus the actual amount of data received. This can lead to both information leaking and out of bounds data reads (usually resulting in a crash). Information leaking can be performed for example by sending a malformed ZRTP Ping packet.

ID	Name	Product	Family	Severity
75177	openSUSE Security Update : libzrtpcpp (openSUSE-SU-2013:1599-1)	Nessus	SuSE Local Security Checks	high
70109	GLSA-201309-13 : GNU ZRTP: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
69025	Fedora 18 : libzrtpcpp-2.3.4-1.fc18 / ortp-0.20.0-5.fc18 / twinkle-1.4.2-19.fc18.1 (2013-13019)	Nessus	Fedora Local Security Checks	high
69024	Fedora 17 : libzrtpcpp-2.3.4-1.fc17 / ortp-0.20.0-5.fc17 / twinkle-1.4.2-19.fc17.1 (2013-13018)	Nessus	Fedora Local Security Checks	high
68893	Fedora 19 : libzrtpcpp-2.3.4-1.fc19 (2013-12479)	Nessus	Fedora Local Security Checks	high
67249	FreeBSD : libzrtpcpp -- multiple security vulnerabilities (04320e7d-ea66-11e2-a96e-60a44c524f57)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2013-2222

critical

Tenable Plugins

high

high

high

high

high

high