Multiple flaws in telecoms stack software FreeSwitch uncovered

guest · Nov 1, 2021

Multiple flaws in telecoms stack software FreeSwitch uncovered
Authentication and denial of service risks for DIY PBX tech patched
November 1, 2021
https://portswigger.net/daily-swig/multiple-flaws-in-telecoms-stack-software-freeswitch-uncovered

Security researchers have gone public about a set of five vulnerabilities in telecoms stack software FreeSwitch.

The quintet of flaws – all discovered by a team from German telecoms security consultancy Enable Security – lead to denial of service, authentication problems and information leakage for systems running FreeSwich.
FreeSwitch is an open source, software-defined telecoms stack that allows multi-purpose devices, ranging from a Raspberry-Pi to multi-core servers, to act as telecoms switches.
Click to expand...

The first vulnerability (tracked as CVE-2021-41105, with a CVSS Score of 7.5) makes it possible for an attacker to disconnect any ongoing calls by flooding a FreeSwitch installation with invalid SRTP (Secure Real-time Transport Protocol) packets.

Another high-severity flaw (CVE-2021-41145, CVSS score 8.6) leaves FreeSwitch at risk of denial of service through SIP flooding. Memory on a device can be exhausted if an attack targets a switch with enough junk SIP messages.
As with the previous flaw, no authentication is required.
Click to expand...

A third high severity vulnerability (CVE-2021-37624) stemmed from shortcomings in how FreeSwitch authenticated SIP message requests.

In a technical blog post, Enable Security explains these various vulnerabilities in more depth. The Daily Swig asked it to estimate the number of potential vulnerable systems as well as offering a take on lessons that might be gleaned from its research.
Click to expand...

We’re yet to hear back, but one message is crystal clear from Enable Security’s blog post: businesses running the affected software should patch their systems or risk being compromised.
Click to expand...

Log in or Sign up

Multiple flaws in telecoms stack software FreeSwitch uncovered

guest Guest

Log in or Sign up

Multiple flaws in telecoms stack software FreeSwitch uncovered

guest Guest

Useful Searches