CVE-2021-37706: Potential integer underflow upon receiving STUN message in PJSIP
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ringto a version that resolves this vulnerability.Fixed in 20180228.1.503 - Upgrade
Upgrade
ubuntu/ringto a version that resolves this vulnerability.Fixed in 20190215.1. - Upgrade
Upgrade
ubuntu/ringto a version that resolves this vulnerability.Fixed in 20230206.0~ - Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:22.10.1+dfsg+~cs6.17.60671434-1 - Upgrade
Upgrade
debian/ringto a version that resolves this vulnerability.Fixed in 20230206.0~ds2-1.1+deb12u1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2021-37706?
CVE-2021-37706 is a vulnerability in the PJSIP library that allows an attacker to execute arbitrary code or cause a denial-of-service.
Which software versions are affected by CVE-2021-37706?
Versions up to and including PJSIP 2.11.1, Asterisk Certified Asterisk 16.8.0, Sangoma Asterisk 16.0.0 to 16.24.1, Sangoma Asterisk 18.0.0 to 18.10.1, Sangoma Asterisk 19.0.0 to 19.2.1, Debian Debian Linux 9.0 and 10.0, and Ubuntu ring package versions 20180228.1.503, 20190215.1., and 20230206.0~ are affected by CVE-2021-37706.
What is the severity of CVE-2021-37706?
CVE-2021-37706 has a severity rating of 9.8 (Critical).
How does CVE-2021-37706 work?
CVE-2021-37706 works by exploiting a vulnerability in the way PJSIP handles incoming STUN messages with an ERROR-CODE attribute, allowing an attacker to bypass header length checks and potentially execute arbitrary code or cause a denial-of-service.
How can I mitigate CVE-2021-37706?
To mitigate CVE-2021-37706, it is recommended to update to a patched version of the affected software as soon as it becomes available. Additionally, network-level defenses such as firewalls and intrusion detection systems may help detect and block exploitation attempts.