Bug 46811 - pjproject: Multiple issues (4.3)
pjproject: Multiple issues (4.3)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.3
All Linux
: P3 normal (vote)
: UCS 4.3-0-errata
Assigned To: Philipp Hahn
Arvid Requate
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-04-12 12:27 CEST by Philipp Hahn
Modified: 2018-05-16 17:04 CEST (History)
1 user (show)

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) NVD


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Philipp Hahn univentionstaff 2018-04-12 12:27:22 CEST
New Debian pjproject 2.5.5~dfsg-6+deb9u1 fixes:
This update addresses the following issues:
* CVE-2017-16872: Overflow when parsing numeric fileds in SIP messages
* CVE-2017-16875: Double key unregistration in ioqueue component
* CVE-2018-1000098: Integer overflow in SDP parsing
* CVE-2018-1000099: Null Pointer vulnerability in pjmedia SDP parsing

An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unregistration after an attacker initiates a socket connection with specific settings and sequences. Such double key unregistration will trigger an integer overflow, which may cause ioqueue backends to reject future key registrations.
Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2.
Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2.
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.
Comment 1 Philipp Hahn univentionstaff 2018-04-12 12:49:36 CEST
[4.3-0] 7829942fe5 Bug #46811: pjproject_2.5.5~dfsg-6+deb9u1
Comment 2 Quality Assurance univentionstaff 2018-05-04 16:44:15 CEST
--- mirror/ftp/4.3/unmaintained/4.3-0/source/pjproject_2.5.5~dfsg-6.dsc
+++ apt/ucs_4.3-0-errata4.3-0/source/pjproject_2.5.5~dfsg-6+deb9u1.dsc
@@ -1,3 +1,16 @@
+2.5.5~dfsg-6+deb9u1 [Tue, 03 Apr 2018 10:02:31 +0200] Bernhard Schmidt <berni@debian.org>:
+
+  [ Bernhard Schmidt ]
+  * Fix various security issues
+    - CVE-2017-16872: Overflow when parsing numeric fileds in SIP messages
+    - CVE-2017-16875: Double key unregistration in ioqueue component
+    - CVE-2018-1000098: Integer overflow in SDP parsing
+      (also reported by the Asterisk project as AST-2018-002)
+    - CVE-2018-1000099: Null Pointer vulnerability in pjmedia SDP parsing
+      (also reported by the Asterisk project as AST-2018-003)
+  * Fix resolution of DNS SRV targets that do not have an AAAA record
+    (Closes: #881362)
+
 2.5.5~dfsg-6 [Fri, 02 Jun 2017 08:59:42 +0200] Bernhard Schmidt <berni@debian.org>:
 
   [ Tzafrir Cohen ]
Comment 3 Arvid Requate univentionstaff 2018-05-15 11:15:11 CEST
* No UCS specific patches
* Comparison to previously shipped version ok
* Binary package update Ok
* Advisory adjusted:
  af36ddd000 | Sort CVEs
Comment 4 Arvid Requate univentionstaff 2018-05-16 17:04:22 CEST
<http://errata.software-univention.de/ucs/4.3/67.html>