coTURN TURN server unsafe loopback forwarding default configuration vulnerability

Summary An exploitable unsafe default configuration vulnerability exists in the TURN server functionality of coTURN prior to 4.5.0.9. By default, the TURN server allows relaying external traffic to the loopback interface of its own host. This can provide access to other private services running o...

coTURN Administrator Web Portal SQL injection vulnerability

Summary An exploitable SQL injection vulnerability exists in the administrator web portal function of coTURN prior to version 4.5.0.9. A login message with a specially crafted username can cause an SQL injection, resulting in authentication bypass, which could give access to the TURN server...

coTURN server unsafe telnet admin portal default configuration vulnerability

Summary An exploitable unsafe default configuration vulnerability exists in the TURN server function of coTURN prior to version 4.5.0.9. By default, the TURN server runs an unauthenticated telnet admin portal on the loopback interface. This can provide administrator access to the TURN server...

PT-2017-3788

Name of the Vulnerable Software and Affected Versions coTURN versions prior to 4.5.0.9 Description The issue is related to an error in encoding registration data in the coTURN server function. This can allow a remote attacker to gain administrator access to the server via the telnet port. The TUR...

PT-2017-3954

Name of the Vulnerable Software and Affected Versions coTURN versions prior to 4.5.0.9 Description The issue is related to a lack of protection against SQL injection in the coTURN server function. An attacker can exploit this by sending a specially crafted username in a login message, resulting i...