[ad_1]
As many as 5 safety vulnerabilities have been disclosed within the PJSIP open-source multimedia communication library that could possibly be abused by an attacker to set off arbitrary code execution and denial-of-service (DoS) in functions that use the protocol stack.
The weaknesses had been recognized and reported by JFrog’s Safety Analysis crew, following which the undertaking maintainers launched patches (model 2.12) final week on February 24, 2022.
PJSIP is an open-source embedded SIP protocol suite written in C that helps audio, video, and instantaneous messaging options for widespread communication platforms comparable to WhatsApp and BlueJeans. It is also used by Asterisk, a widely-used personal department alternate (PBX) switching system for VoIP networks.
“Buffers utilized in PJSIP sometimes have restricted sizes, particularly those allotted within the stack or provided by the appliance, nonetheless in a number of locations, we don’t test if our utilization can exceed the sizes,” PJSIP’s developer Sauw Ming famous in an advisory posted on GitHub final month, a situation that would end in buffer overflows.
The listing of flaws is as follows –
- CVE-2021-43299 (CVSS rating: 8.1) – Stack overflow in PJSUA API when calling pjsua_player_create()
- CVE-2021-43300 (CVSS rating: 8.1) – Stack overflow in PJSUA API when calling pjsua_recorder_create()
- CVE-2021-43301 (CVSS rating: 8.1) – Stack overflow in PJSUA API when calling pjsua_playlist_create()
- CVE-2021-43302 (CVSS rating: 5.9) – Learn out-of-bounds in PJSUA API when calling pjsua_recorder_create()
- CVE-2021-43303 (CVSS rating: 5.9) – Buffer overflow in PJSUA API when calling pjsua_call_dump()
Profitable exploitation of the aforementioned flaws may allow a malicious actor to move attacker-controlled arguments to any of the susceptible APIs, resulting in code execution and a DoS situation, Uriya Yavnieli, JFrog researcher who reported the issues, stated.
[ad_2]
