FreeSWITCHでDTLS-SRTPの証明書照合が省かれ、メディアを盗聴・差し替えられる脆弱性
Summary
FreeSWITCHがDTLSサーバーの役割を担うとき、相手の証明書がSDPのfingerprintと照合されず、別の証明書で握手されるおそれがあります。1.11.2より前のバージョンが対象で、修正版は1.11.2です。ICEを使う接続では通信確認用の認証情報も必要なため、悪用の条件は限られますが、修正版への更新を計画してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
FreeSWITCHがDTLSサーバーの役割を担うとき、相手の証明書がSDPのfingerprintと照合されず、別の証明書で握手されるおそれがあります。1.11.2より前のバージョンが対象で、修正版は1.11.2です。ICEを使う接続では通信確認用の認証情報も必要なため、悪用の条件は限られますが、修正版への更新を計画してください。
Original description The description as published by the source.
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, dtls_state_setup() compared a peer certificate with the SDP a=fingerprint only when FreeSWITCH was the DTLS client, not when it held the DTLS server role. An unauthenticated peer able to reach the negotiated media port could complete the DTLS-SRTP handshake with an unrelated certificate, obtain the leg's SRTP keys, decrypt and inject media, and displace the legitimate endpoint; on ICE-enabled legs the peer also needs the connectivity-check credentials from SDP, which generally requires signaling visibility or a position on its path. WebRTC and SIP DTLS-SRTP legs are affected whenever the peer selects the active role, while FreeSWITCH client-role handshakes already perform fingerprint validation. Version 1.11.2 introduces the remediation, which requires rtp_dtls_client_cert_verify_mode=fingerprint.
Source: CVE.org (CVE Program・cvelistV5) NVD