murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or crash) via a message flood.

This update for mumble fixes the following issues :

CVE-2018-20743: murmur mishandled multiple concurrent requests that were persisted in the database, which allowed remote attackers to cause a denial of service (daemon hang or crash) via a message flood.
(boo#1123334)

It was discovered that insufficient restrictions in the connection handling of Mumble, a low latency encrypted VoIP client, could result in denial of service.

It has been found that the mumble-server mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or crash) via a message flood. With the new security update a rate limiter is added with Leaky-Bucket algorithm.

For Debian 8 'Jessie', this problem has been fixed in version 1.2.8-2+deb8u1.

We recommend that you upgrade your mumble packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
126978	openSUSE Security Update : mumble (openSUSE-2019-1794)	Nessus	SuSE Local Security Checks	high
122621	Debian DSA-4402-1 : mumble - security update	Nessus	Debian Local Security Checks	high
121624	Debian DLA-1661-1 : mumble security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-20743

high

Tenable Plugins

high

high

high