USN-4415-1: coTURN vulnerabilities

🗓️ 06 Jul 2020 17:11:29Reported by UbuntuType

coTURN vulnerabilities, coTURN response buffer not initialized properly, coTURN web server handling HTTP POST request

Reporter	Title	Published	Views	Family All 84
AlpineLinux	CVE-2020-4067	29 Jun 202019:55	–	alpinelinux
BDU FSTEC	The vulnerability of the Coturn web server, related to the swapping of the zero pointer, allows attackers to trigger a service failure.	19 Aug 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Coturn web server involves an operation that goes beyond the allowed buffer data limits. This allows attackers to access confidential data, compromise its integrity, and cause service failures.	19 Aug 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the STUN/TURN response buffer in the Coturn web server allows a attacker to access confidential data.	19 Aug 202000:00	–	bdu_fstec
CNVD	CoTURN Buffer Overflow Vulnerability	20 Feb 202000:00	–	cnvd
CNVD	CoTURN Information Disclosure Vulnerability	30 Jun 202000:00	–	cnvd
Check Point Advisories	CoTURN Heap Overflow (CVE-2020-6061)	8 Jul 202000:00	–	checkpoint_advisories
CVE	CVE-2020-4067	29 Jun 202019:55	–	cve
CVE	CVE-2020-6061	19 Feb 202018:27	–	cve
CVE	CVE-2020-6062	19 Feb 202018:25	–	cve

OS	OS Version	Architecture	Package	Package Version	Filename
Ubuntu	16.04	any	coturn	4.5.0.3-1ubuntu0.3	coturn_4.5.0.3-1ubuntu0.3_any.deb
Ubuntu	18.04	any	coturn	4.5.0.7-1ubuntu2.18.04.2	coturn_4.5.0.7-1ubuntu2.18.04.2_any.deb
Ubuntu	19.10	any	coturn	4.5.1.1-1.1ubuntu0.19.10.1	coturn_4.5.1.1-1.1ubuntu0.19.10.1_any.deb
Ubuntu	20.04	any	coturn	4.5.1.1-1.1ubuntu0.20.04.1	coturn_4.5.1.1-1.1ubuntu0.20.04.1_any.deb

06 Jul 2020 17:11Current

7.1High risk

Vulners AI Score7.1

CVSS 27.5

CVSS 3.17 - 9.8

CVSS 37

EPSS0.05955