Patch Ticker

FreeSWITCH telecom server memory flaws (crash, command run)

Internet phone servers can be stopped, dropping all calls!

Summary

FreeSWITCH telecom servers have several memory overflow and bad-read flaws. Unauthenticated attackers can crash the server and drop all calls, and some let a logged-in user run commands on the server. Versions before 1.11.2 are affected.

Affected when

  • Versions before 1.11.2
  • Video relay (mod_rtmp) module built and loaded
  • XML remote control (mod_xml_rpc) enabled
  • MSRP message port enabled
  • Presence management enabled

What to do

Update to 1.11.2 or later. If you cannot update now, turn off the affected features and do not expose admin pages to the internet.

Products and platforms

  • freeswitch

CVE IDs

Sources

Times

First published

First seen