Gnugk
Monthly
GNU Gatekeeper (gnugk) before 5.16 can be crashed by a deliberately short application-defined RTCP probe packet delivered to the H.460.24 media port, because H46024Socket::ReceivedProbePacket() copies 20 bytes from offset 12 of the frame without first checking that the frame is long enough, producing a heap over-read. Only gatekeepers that have H.460.24 NAT traversal in use and have an H.460.24 probing exchange in progress are reachable by the flaw, so realistic impact is limited to process termination on a network-reachable, unauthenticated but timing-constrained path rather than data disclosure or code execution. No public exploit has been identified at time of analysis, and version 5.16 contains the vendor fix.
An out-of-bounds heap read in GNU Gatekeeper (gnugk) before 5.16 lets a remote RTP peer crash the gatekeeper by sending a crafted RTCP SDES packet on the media proxy port of an in-progress proxied H.323 call. The vulnerable ParseRTCP() code in ProxyChannel.cxx treats the SDES item payload as a NUL-terminated string, so an item that lacks a terminating NUL causes a length-based read past the received packet when EnableRTCPStats is enabled - a non-default option - and the only demonstrated impact is denial of service (A:H, no confidentiality or integrity impact). The vendor addressed it in release 5.16 via commit e8939d0, and no public exploit code or in-the-wild activity was identified at the time of analysis; severity is medium (vendor CVSS 4.0 base 6.3) because exploitation requires a live, media-proxied call plus RTCP statistics processing.
GNU Gatekeeper (gnugk) before 5.16 can be crashed by a deliberately short application-defined RTCP probe packet delivered to the H.460.24 media port, because H46024Socket::ReceivedProbePacket() copies 20 bytes from offset 12 of the frame without first checking that the frame is long enough, producing a heap over-read. Only gatekeepers that have H.460.24 NAT traversal in use and have an H.460.24 probing exchange in progress are reachable by the flaw, so realistic impact is limited to process termination on a network-reachable, unauthenticated but timing-constrained path rather than data disclosure or code execution. No public exploit has been identified at time of analysis, and version 5.16 contains the vendor fix.
An out-of-bounds heap read in GNU Gatekeeper (gnugk) before 5.16 lets a remote RTP peer crash the gatekeeper by sending a crafted RTCP SDES packet on the media proxy port of an in-progress proxied H.323 call. The vulnerable ParseRTCP() code in ProxyChannel.cxx treats the SDES item payload as a NUL-terminated string, so an item that lacks a terminating NUL causes a length-based read past the received packet when EnableRTCPStats is enabled - a non-default option - and the only demonstrated impact is denial of service (A:H, no confidentiality or integrity impact). The vendor addressed it in release 5.16 via commit e8939d0, and no public exploit code or in-the-wild activity was identified at the time of analysis; severity is medium (vendor CVSS 4.0 base 6.3) because exploitation requires a live, media-proxied call plus RTCP statistics processing.