CVE-2023-40018

FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID

Severity Score

7.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Attend

*SSVC

Descriptions

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.10, FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID. When an SDP is offered with any ICE candidates with an unknown component ID, FreeSWITCH will make an out of bounds write to its arrays. By abusing this vulnerability, an attacker is able to corrupt FreeSWITCH memory leading to an undefined behavior of the system or a crash of it. Version 1.10.10 contains a patch for this issue.

FreeSWITCH es una pila de telecomunicaciones definida por software que permite la transformación digital de switches de telecomunicaciones propietarios a una implementación de software que se ejecuta en cualquier hardware básico. Antes de la versión 1.10.10, FreeSWITCH permitía a los usuarios remotos activar escritura fuera de límites ofreciendo un candidato ICE con un ID de componente desconocido. Cuando se ofrece un SDP con candidatos ICE con un ID de componente desconocido, FreeSWITCH realizará una escritura fuera de límites en sus matrices. Al abusar de esta vulnerabilidad, un atacante puede corromper la memoria de FreeSWITCH, lo que provoca un comportamiento indefinido del sistema o un bloqueo del mismo. La versión 1.10.10 contiene un parche para este problema.

*Credits: N/A

CVSS Scores

NISTv3.1 7.5

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Attend

Exploitation

Poc

Automatable

Yes

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-08-08 CVE Reserved
2023-09-15 CVE Published
2024-09-25 CVE Updated
2024-10-17 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-787: Out-of-bounds Write

CAPEC

References (2)

URL	Tag	Source
https://github.com/signalwire/freeswitch/releases/tag/v1.10.10	Release Notes

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://github.com/signalwire/freeswitch/security/advisories/GHSA-7mwp-86fv-hcg3	2023-09-21

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Freeswitch Search vendor "Freeswitch"		Freeswitch Search vendor "Freeswitch" for product "Freeswitch"				< 1.10.10 Search vendor "Freeswitch" for product "Freeswitch" and version " < 1.10.10"		-		Affected