CVE-2021-37706: Potential integer underflow upon receiving STUN message in PJSIP
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-37706?
CVE-2021-37706 is a vulnerability in the PJSIP library that allows an attacker to execute arbitrary code or cause a denial-of-service.
Which software versions are affected by CVE-2021-37706?
Versions up to and including PJSIP 2.11.1, Asterisk Certified Asterisk 16.8.0, Sangoma Asterisk 16.0.0 to 16.24.1, Sangoma Asterisk 18.0.0 to 18.10.1, Sangoma Asterisk 19.0.0 to 19.2.1, Debian Debian Linux 9.0 and 10.0, and Ubuntu ring package versions 20180228.1.503, 20190215.1., and 20230206.0~ are affected by CVE-2021-37706.
What is the severity of CVE-2021-37706?
CVE-2021-37706 has a severity rating of 9.8 (Critical).
How does CVE-2021-37706 work?
CVE-2021-37706 works by exploiting a vulnerability in the way PJSIP handles incoming STUN messages with an ERROR-CODE attribute, allowing an attacker to bypass header length checks and potentially execute arbitrary code or cause a denial-of-service.
How can I mitigate CVE-2021-37706?
To mitigate CVE-2021-37706, it is recommended to update to a patched version of the affected software as soon as it becomes available. Additionally, network-level defenses such as firewalls and intrusion detection systems may help detect and block exploitation attempts.