Our news
A Novel DoS Vulnerability Affecting WebRTC Media Servers
We have just published our latest research on a vulnerability affecting multiple WebRTC media servers. This issue has been notably fixed in Asterisk, FreeSWITCH, and rtpengine. However, we also discovered it on several well-known public platforms, VoIP services, and proprietary media servers.
TL;DR:
A critical denial-of-service (DoS) vulnerability has been identified in media servers that process WebRTC’s DTLS-SRTP, specifically in their handling of ClientHello messages. This vulnerability arises from a race condition between ICE and DTLS traffic and can be exploited to disrupt media sessions, compromising the availability of real-time communication services. Mitigations include filtering packets based on ICE-validated IP and port combinations. The article also indicates safe testing methods and strategies for detecting the attack.
Read the rest of the blog post on our website.
Enable Security Consultancy Services
Not ready for a full penetration test? We offer consultancy to help you set up security tests for your VoIP and WebRTC systems. We’ll provide security advice, identify potential security flaws, and assist with critical security decisions.
Contact us by responding to this email or clicking here.
Heated Debate on Whether the WebRTC Specs Contain a Vulnerability
Our blog post sparked an engaging discussion on X (formerly Twitter) about whether the vulnerability stems from a lack of security documentation in the RFCs or if it is merely an implementation issue.
Ultimately, even those who strongly believed that this is not a vulnerability in the specs agreed that the specifications may need more explicit guidance on the receiving of media traffic after ICE media consent verification.
We’d like to thank Iñaki, Philipp Hancke, Lorenzo Miniero, Sergio Garcia Murillo, and Nils Ohlmeier for their contributions to this discussion.
Presenting and Meeting Friends at WarCon
This month, I attended WarCon, a small and intimate conference in Warsaw, Poland. The presentations were captivating, as were the various conversations with fellow hackers. I presented on the WebRTC media server vulnerability, aiming to inspire security professionals to explore VoIP and WebRTC.
One of the main challenges of my presentation was explaining enough technical background on WebRTC for the vulnerability to be understood, without getting lost in the details. I tried, with limited success, to accomplish this in just 20 minutes.
The presentation slides are available here.
Many thanks to the engaged audience, especially Simone Margaritelli who drew my attention to his own work where he met some of the same protocols (ICE) as used by the Apple MultiPeer Connectivity Framework.
What’s Happening?
Military and Political Implications of Cisco WebEx Vulnerabilities
The German media has reported on vulnerabilities in Cisco WebEx that allowed unauthorized access to virtual meetings, including those of the German armed forces and several major political parties. This issue also affected other countries, such as the Dutch government, which expressed significant dissatisfaction.
Help Net Security provides comprehensive coverage of the situation. The main concern is that tens of thousands of sensitive meetings could be compromised due to the following security vulnerabilities:
- Predictable meeting IDs: Predictable numbers make it easy to guess WebEx meeting locations if a previous meeting ID is known. This allows access to call metadata, including meeting titles, host names, and other data, even if a password is set.
- PSTN security bypass: When dialing in via PSTN, a password required for the online meeting can (apparently) be bypassed by simply pressing the hash key, granting access to the meeting.
Meetings without a password could be accessed with just the meeting ID.
These vulnerabilities were initially discovered by Netzbegrünung, which has detailed the issue in two blog posts (in German):
We have not verified these vulnerabilities ourselves. Cisco addressed and fixed the meeting ID issue earlier this month. So, nothing to see here, move along!
Additional Chrome WebRTC Security Fixes (CVE-2024-5493)
Cassidy Kim, a bug hunter, has identified multiple security vulnerabilities in the WebRTC project. Last month, Chromium released security fixes for the latest WebRTC vulnerability reported by Kim and awarded them 7000 USD. This update also addresses another issue, a use-after-free vulnerability in Media Session reported by Kim, tracked as CVE-2024-5496.
Browsers based on Chromium should also be updated.
Although no detailed information has been released, xvonfers on X (Twitter) shared a link to a test case that reproduces the issue, accompanied by the following comment:
(CVE-2024-5493)[339877165][AV1] Initialize encoder with specific settings -> start encoding video -> change resolution/SVC layers dynamically -> desynchronized buffer allocation -> Heap BoF during encoding.
Short News
CoreMedia Update in iTunes for Windows to Address H26Forge Vulnerability
Apple issued an update for iTunes for Windows to address CVE-2024-27793, which is one of the vulnerabilities found by the team at The University of Texas at Austin during their H26Forge research. We had briefly covered this paper in last year’s April newsletter. The paper focuses on H.264 video files, but H.264 may also be used for WebRTC and ViLTE (video over LTE).
Codec security is a significant concern for us and the RTC security community. Congratulations to Willy R. Vasquez and his colleagues for the Forbes news coverage!
Mitel Phone Vulnerability Information Published
Security researcher Kyle Burns has released exploit code and advisories for vulnerabilities affecting Mitel devices:
- An authenticated remote command injection vulnerability on the provis.html page allows for code execution on boot. This issue affects Mitel versions 4.5.0.41 and 5.0.0.1018. More details can be found here, and it is tracked as CVE-2024-37569.
- An authenticated remote command injection vulnerability on the upgrade.html page allows for code execution. This affects the same Mitel versions. More details are available here, and it is tracked as CVE-2024-37570.
A demonstration video is available on YouTube, showcasing the exploitation of CVE-2024-37569, where the author gains root access to the phone.
These vulnerabilities are not listed on the Mitel Security Advisories website,
as the affected versions are no longer maintained. If you are affected, upgrading your firmware is recommended.
Additionally, there is a third vulnerability mentioned in the Github repository, but no information has been published yet. The description is as follows:
Missing sanitization in multiple endpoints allows the ability to smuggle configuration entries to overwrite valid entries, eventually leading to authenticated remote command injection Mitel 6.3.0.1020 A-RCE.
This vulnerability is expected to be fixed soon in the latest Mitel phone firmware.
