Bug 46811

Summary:	pjproject: Multiple issues (4.3)
Product:	UCS	Reporter:	Philipp Hahn <hahn>
Component:	Security updates	Assignee:	Philipp Hahn <hahn>
Status:	CLOSED FIXED	QA Contact:	Arvid Requate <requate>
Severity:	normal
Priority:	P3	CC:	requate
Version:	UCS 4.3
Target Milestone:	UCS 4.3-0-errata
Hardware:	All
OS:	Linux
What kind of report is it?:	Security Issue	What type of bug is this?:	---
Who will be affected by this bug?:	---	How will those affected feel about the bug?:	---
User Pain:		Enterprise Customer affected?:
School Customer affected?:		ISV affected?:
Waiting Support:		Flags outvoted (downgraded) after PO Review:
Ticket number:		Bug group (optional):
Max CVSS v3 score:	9.8 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) NVD

Description Philipp Hahn

2018-04-12 12:27:22 CEST

New Debian pjproject 2.5.5~dfsg-6+deb9u1 fixes:
This update addresses the following issues:
* CVE-2017-16872: Overflow when parsing numeric fileds in SIP messages
* CVE-2017-16875: Double key unregistration in ioqueue component
* CVE-2018-1000098: Integer overflow in SDP parsing
* CVE-2018-1000099: Null Pointer vulnerability in pjmedia SDP parsing

An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. The ioqueue component may issue a double key unregistration after an attacker initiates a socket connection with specific settings and sequences. Such double key unregistration will trigger an integer overflow, which may cause ioqueue backends to reject future key registrations.
Teluu PJSIP version 2.7.1 and earlier contains a Access of Null/Uninitialized Pointer vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2.
Teluu PJSIP version 2.7.1 and earlier contains a Integer Overflow vulnerability in pjmedia SDP parsing that can result in Crash. This attack appear to be exploitable via Sending a specially crafted message. This vulnerability appears to have been fixed in 2.7.2.
An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq, ttl, port, etc.) all had the potential to overflow, either causing unintended values to be captured or, if the values were subsequently converted back to strings, a buffer overrun. This will lead to a potential exploit using carefully crafted invalid values.

Comment 1 Philipp Hahn

2018-04-12 12:49:36 CEST

[4.3-0] 7829942fe5 Bug #46811: pjproject_2.5.5~dfsg-6+deb9u1

Comment 2 Quality Assurance

2018-05-04 16:44:15 CEST

--- mirror/ftp/4.3/unmaintained/4.3-0/source/pjproject_2.5.5~dfsg-6.dsc
+++ apt/ucs_4.3-0-errata4.3-0/source/pjproject_2.5.5~dfsg-6+deb9u1.dsc
@@ -1,3 +1,16 @@
+2.5.5~dfsg-6+deb9u1 [Tue, 03 Apr 2018 10:02:31 +0200] Bernhard Schmidt <berni@debian.org>:
+
+  [ Bernhard Schmidt ]
+  * Fix various security issues
+    - CVE-2017-16872: Overflow when parsing numeric fileds in SIP messages
+    - CVE-2017-16875: Double key unregistration in ioqueue component
+    - CVE-2018-1000098: Integer overflow in SDP parsing
+      (also reported by the Asterisk project as AST-2018-002)
+    - CVE-2018-1000099: Null Pointer vulnerability in pjmedia SDP parsing
+      (also reported by the Asterisk project as AST-2018-003)
+  * Fix resolution of DNS SRV targets that do not have an AAAA record
+    (Closes: #881362)
+
 2.5.5~dfsg-6 [Fri, 02 Jun 2017 08:59:42 +0200] Bernhard Schmidt <berni@debian.org>:
 
   [ Tzafrir Cohen ]

Comment 3 Arvid Requate

2018-05-15 11:15:11 CEST

* No UCS specific patches
* Comparison to previously shipped version ok
* Binary package update Ok
* Advisory adjusted:
  af36ddd000 | Sort CVEs

Comment 4 Arvid Requate

2018-05-16 17:04:22 CEST

<http://errata.software-univention.de/ucs/4.3/67.html>