In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This has been fixed in 4.5.1.3.

This update for coturn fixes the following issues :

Version 4.5.1.3 :

  - Remove reference to SSLv3: gh#coturn/coturn#566

  - Ignore MD5 for BoringSSL: gh#coturn/coturn#579

  - STUN response buffer not initialized properly; he issue     found and reported gh#coturn/coturn#583 by Felix     D&ouml;rre all credits belongs to him. CVE-2020-4067,     boo#1173510

  - Let coturn allow binding to ports below 1024 per default

Coturn 4.5.1.3 ==============

  - merge PR #575: Fix rpm packaging

  - merge PR #576: Tell tar to not include the metadata into     release

  - merge PR #574: Change Docker `turnserver.conf` to latest     `turnserver.conf`

  - merge PR #566: Remove reference to SSLv3

  - merge PR #579: Ignore MD5 for BoringSSL

  - merge PR #577: Build RPM from local folder instead of     Git repo

  - Fix for CVE-2020-4067: STUN response buffer not     initialized properly (issue found and reported #583 by     Felix D&ouml;rre)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4415-1 advisory.

    Felix Drre discovered that coTURN response buffer is not initialized properly. An attacker could     possibly use this issue to obtain sensitive information. (CVE-2020-4067)

    It was discovered that coTURN web server incorrectly handled HTTP POST requests. An attacker could     possibly use this issue to cause a denial of service, obtain sensitive information or other unspecified     impact. (CVE-2020-6061, CVE-2020-6062)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Felix Dorre reports :

The issue is that STUN/TURN response buffer is not initialized properly. (CWE 665) This is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client.

In coturn before version 4.5.1.3, there is an issue whereby STUN/TURN response buffer is not initialized properly. There is a leak of information between different client connections. One client (an attacker) could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client.

For Debian 8 'Jessie', this problem has been fixed in version 4.2.1.2-1+deb8u2.

We recommend that you upgrade your coturn packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in coturn, a TURN and STUN server for VoIP.

  - CVE-2020-4067     Felix Doerre reported that the STUN response buffer was     not properly initialised, which could allow an attacker     to leak bytes in the padding bytes from the connection     of another client.

  - CVE-2020-6061     Aleksandar Nikolic reported that a crafted HTTP POST     request can lead to information leaks and other     misbehavior.

  - CVE-2020-6062     Aleksandar Nikolic reported that a crafted HTTP POST     request can lead to server crash and denial of service.

ID	Name	Product	Family	Severity
138728	openSUSE Security Update : coturn (openSUSE-2020-937)	Nessus	SuSE Local Security Checks	high
138241	Fedora 32 : coturn (2020-d946f64eea)	Nessus	Fedora Local Security Checks	high
138238	Fedora 31 : coturn (2020-9eadf517de)	Nessus	Fedora Local Security Checks	high
138165	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : coTURN vulnerabilities (USN-4415-1)	Nessus	Ubuntu Local Security Checks	critical
138130	FreeBSD : coturn -- information leakage (fce7a6e7-bc5d-11ea-b38d-f0def1d0c3ea)	Nessus	FreeBSD Local Security Checks	high
138064	Debian DLA-2271-1 : coturn security update	Nessus	Debian Local Security Checks	high
137888	Debian DSA-4711-1 : coturn - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-4067

high

Tenable Plugins

high

high

high

critical

high

high

critical