A buffer overflow flaw was reported [1] in libsrtp, Cisco's reference implementation of the Secure Real-time Transport Protocol (SRTP), in how the cryptopolicysetfromprofileforrtp() function applies cryptographic profiles to an srtppolicy. This could allow for a crash of a client linked against libsrtp (like asterisk or linphone).

A pull request in git [2] has a patch to correct this issue.

[1] http://seclists.org/fulldisclosure/2013/Jun/10 [2] https://github.com/cisco/libsrtp/pull/26

Randell Jesup and the Firefox team discovered that srtp, Cisco's reference implementation of the Secure Real-time Transport Protocol (SRTP), does not properly handle RTP header CSRC count and extension header length. A remote attacker can exploit this vulnerability to crash an application linked against libsrtp, resulting in a denial of service.

References:

http://seclists.org/bugtraq/2016/Apr/11

A buffer overflow flaw was reported [1] in libsrtp, Cisco's reference implementation of the Secure Real-time Transport Protocol (SRTP), in how the cryptopolicysetfromprofileforrtp() function applies cryptographic profiles to an srtppolicy. This could allow for a crash of a client linked against libsrtp (like asterisk or linphone).

A pull request in git [2] has a patch to correct this issue.

[1] http://seclists.org/fulldisclosure/2013/Jun/10 [2] https://github.com/cisco/libsrtp/pull/26

Randell Jesup and the Firefox team discovered that srtp, Cisco's reference implementation of the Secure Real-time Transport Protocol (SRTP), does not properly handle RTP header CSRC count and extension header length. A remote attacker can exploit this vulnerability to crash an application linked against libsrtp, resulting in a denial of service.

References:

http://seclists.org/bugtraq/2016/Apr/11