An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server configuration, which can lead to additional attacks. An attacker who can get access to the telnet port can gain administrator access to the TURN server.

Multiple vulnerabilities were discovered in coTURN, a TURN and STUN server for VoIP.

CVE-2018-4056

A SQL injection vulnerability was discovered in the coTURN administrator web portal. As the administration web interface is shared with the production, it is unfortunately not possible to easily filter outside access and this security update completely disables the web interface. Users should use the local, command line interface instead.

CVE-2018-4058

Default configuration enables unsafe loopback forwarding. A remote attacker with access to the TURN interface can use this vulnerability to gain access to services that should be local only.

CVE-2018-4059

Default configuration uses an empty password for the local command line administration interface. An attacker with access to the local console (either a local attacker or a remote attacker taking advantage of CVE-2018-4058) could escalade privileges to administrator of the coTURN server.

For Debian 8 'Jessie', these problems have been fixed in version 4.2.1.2-1+deb8u1.

We recommend that you upgrade your coturn packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Mihaly Meszaros reports :

We made 4.5.1.0 release public today that fixes many vulnerabilities.

It fix the following vulnerabilities :

- CVE-2018-4056

- CVE-2018-4058

- CVE-2018-4059

They will be exposed very soon..

Multiple vulnerabilities were discovered in coTURN, a TURN and STUN server for VoIP.

  - CVE-2018-4056     A SQL injection vulnerability was discovered in the     coTURN administrator web portal. As the administration     web interface is shared with the production, it is     unfortunately not possible to easily filter outside     access and this security update completely disable the     web interface. Users should use the local, command line     interface instead.

  - CVE-2018-4058     Default configuration enables unsafe loopback     forwarding. A remote attacker with access to the TURN     interface can use this vulnerability to gain access to     services that should be local only.

  - CVE-2018-4059     Default configuration uses an empty password for the     local command line administration interface. An attacker     with access to the local console (either a local     attacker or a remote attacker taking advantage of     CVE-2018-4058 ) could escalade privileges to     administrator of the coTURN server.

ID	Name	Product	Family	Severity
122098	Debian DLA-1671-1 : coturn security update	Nessus	Debian Local Security Checks	critical
121495	FreeBSD : turnserver -- multiple vulnerabilities (181beef6-2482-11e9-b4a3-00155d006b02)	Nessus	FreeBSD Local Security Checks	critical
121425	Debian DSA-4373-1 : coturn - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-4059

critical

Tenable Plugins

critical

critical

critical