resiprocate

Overview The reSIProcate repository contains the following C++ libraries and applications: resip library: comprehensive RFC3261 SIP stack dum Dialog Usage Manager library: high level SIP library for creating SIP user agents no media stack recon library: high level SIP UA library with media stack...

stunner

STUNNER Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers. TURN is a protocol mostly used in videoconferencing and audio chats WebRTC. If you find a misconfigured server you can use this tool to open a local socks proxy that relays all traffic via the TURN protocol into t...

webrtc-ips

WebRTC 向け STUN IP アドレス要求 デモ: https://diafygi.github.io/webrtc-ips/ これは何をするか Firefox と Chrome には、ユーザーのローカル IP アドレスとパブリック IP アドレスを返す STUN サーバーへの要求を可能にする WebRTC が実装されています。この要求の結果は JavaScript から利用できるため、JavaScript でユーザーのローカル IP アドレスとパブリック IP アドレスを取得できるようになりました。このデモは、その実装例です。 さらに、これらの STUN 要求は通常の...

WireBug

WireBug WireBug is a tool set for Voice-over-IP penetration testing. It is designed as a wizard which makes it easy to use. The tools are build for single using too, so every tool is its own python or bash program. Installation Read the Installation Guide in the wiki. Tools FullBridge: This is a...

zeek-spicy-stun

STUN NAT用セッション横断ユーティリティ（STUN） これは、Spicy ベースで STUN を検出する Zeek プロトコルアナライザです。 このパッケージを使用するには、Spicy をインストールする必要があります。 このパッケージは2つのログを生成します： stun.log - このログにはすべての STUN メッセージが含まれます。 stunnat.log - このログには、マップされたアドレスからの NAT 検出結果が含まれます。 以下の元のロジックに追加のロジックが加えられています： https://github.com/r-franke/spicystun...

CVE-2026-54632

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while...

CVE-2026-54632 SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

SIPSorcery is a WebRTC, SIP, and VoIP library for C and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path index untrusted bytes without sufficient length checks, while...

SUSE CVE-2026-54909

pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3...

CVE-2026-68552

A flaw was found in Coturn. An unauthenticated remote client can send a specially crafted STUN message over TCP or TLS. This message, with a specific body-length field, causes an integer truncation overflow, leading to the desynchronization of the stream parser. Consequently, the attacking client...

CVE-2026-68554

A flaw was found in Coturn, a free open source implementation of TURN and STUN Session Traversal Utilities for NAT Server. An on-path attacker can exploit this vulnerability on plain UDP or TCP by appending attributes after the MESSAGE-INTEGRITY field in an authenticated STUN request. This allows...

CVE-2026-68553

A flaw was found in Coturn. An authenticated TURN user can exploit a format string vulnerability by injecting printf-style format specifiers into the STUN USERNAME or REALM attribute. This can lead to a crash of the coturn process, resulting in a Denial of Service DoS and termination of active TU...

Linux Distros Unpatched Vulnerability : CVE-2026-68554

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an...

Linux Distros Unpatched Vulnerability : CVE-2026-68552

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS...

Linux Distros Unpatched Vulnerability : CVE-2026-68553

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the...

DEBIAN-CVE-2026-68552

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16t len variable in stungetmessagelenstr in src/client/nsturnmsg.c to...

CVE-2026-68554

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...

DEBIAN-CVE-2026-68554

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an on-path attacker can append attributes after MESSAGE-INTEGRITY to an authenticated STUN request on plain UDP or TCP, adjust the STUN header length, and recompute the unkeyed FINGERPRINT while the original HMA...

DEBIAN-CVE-2026-68553

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.13.0, an authenticated TURN user can place printf-style format specifiers in the STUN USERNAME or REALM attribute, which passes issecurestring validation and is embedded into Redis keys at nine call sites in...

CVE-2026-68552

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16t len variable in stungetmessagelenstr in src/client/nsturnmsg.c to...

UBUNTU-CVE-2026-68552

Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, an unauthenticated remote client can send a STUN message over TCP or TLS with a body-length field from 65520 through 65532, causing the uint16t len variable in stungetmessagelenstr in src/client/nsturnmsg.c to...