REDHAT-BUG-970697: Buffer Overflow
A buffer overflow flaw was reported [1] in libsrtp, Cisco's reference implementation of the Secure Real-time Transport Protocol (SRTP), in how the cryptopolicysetfromprofileforrtp() function applies cryptographic profiles to an srtppolicy. This could allow for a crash of a client linked against libsrtp (like asterisk or linphone).
A pull request in git [2] has a patch to correct this issue.
[1] http://seclists.org/fulldisclosure/2013/Jun/10 [2] https://github.com/cisco/libsrtp/pull/26
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-970697?
The severity of REDHAT-BUG-970697 is considered high due to the potential for a buffer overflow vulnerability.
How do I fix REDHAT-BUG-970697?
To fix REDHAT-BUG-970697, update to the latest version of Cisco libsrtp that addresses this buffer overflow flaw.
What are the potential impacts of REDHAT-BUG-970697?
The potential impacts of REDHAT-BUG-970697 include application crashes and possible exploitation leading to arbitrary code execution.
Which software is affected by REDHAT-BUG-970697?
REDHAT-BUG-970697 specifically affects the Cisco libsrtp implementation.
What function is associated with the buffer overflow in REDHAT-BUG-970697?
The buffer overflow in REDHAT-BUG-970697 is associated with the crypto_policy_set_from_profile_for_rtp() function.