Description
reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame lengths. Attackers can send STUN or ChannelData frames declaring up to 65535 bytes, writing roughly 57 KB past the fixed 8192-byte mReadBuffer and crashing the client. Only the synchronous TCP and TLS client is affected; the asynchronous client (TurnAsyncSocket) and the reTurn server are not.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| resiprocate | resiprocate | ≤ 1.14.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | resiprocate | No fix yet | — |
| Ubuntu 16.04 LTS | resiprocate | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | resiprocate | No fix yet | — |
References
- Pull Request #496 issue-tracking patch
- Patch Commit patch
- https://github.com/resiprocate/resiprocate product
- https://github.com/resiprocate/resiprocate/blob/resiprocate-1.14.0/reTurn/client/TurnTcpSocket.cxx#L124-L147 technical-description
- VulnCheck Advisory: reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket third-party-advisory