CVE-2021-37706 Potential integer underflow upon receiving STUN message in PJSIP

What is CVE-2021-37706?

CVE-2021-37706 is a high-severity vulnerability in Debian Debian Linux, published on 22 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.

Weakness: CWE-191

Which versions are affected by CVE-2021-37706?

It affects 4 products.

Products include Asterisk Certified Asterisk, Debian Debian Linux, Sangoma Asterisk, Teluu Pjsip.

How do I fix CVE-2021-37706?

Upgrade to a fixed version.

Is CVE-2021-37706 being exploited?

There is no known exploitation of CVE-2021-37706 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2022-21723 Out-of-bounds read in multipart parsing in PJSIP Critical 9.1
• CVE-2022-23608 Use after free in PJSIP High 8.1
• CVE-2017-9358 Denial of service in n/a High 7.5
• CVE-2021-46837 Null dereference in n/a Medium 6.5
• CVE-2020-28242 Denial of service in n/a Medium 6.5

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as ALPINE-CVE-2021-37706, DEBIAN-CVE-2021-37706, GHSA-2qpg-f6wf-w984, UBUNTU-CVE-2021-37706.