I'd like to request CVEs for multiple security vulnerabilities
discovered, reported, and published by Mark Dowd of Azimuth Security in
GNU ZRTPCPP, an open-source ZRTP implementation used in a number of
"secure phone" solutions:
1. Remote heap overflow
A remote attacker can cause a heap-based buffer overflow by sending an
overly-large ZRTP packet of several possible types, including a "Hello"
packet. Successful exploitation would allow an attacker to execute
arbitrary code in the context of a vulnerable application.
2. Multiple remote stack overflows
A remote attacker can cause multiple stack-based buffer overflows by
sending a malformed ZRTP Hello packet with an overly-large value in
certain fields, including the count of public keys. Exploitation may be
difficult due to the details of the layout of stack variables in memory,
but successful exploitation would allow an attacker to execute arbitrary
code in the context of a vulnerable application.
3. Multiple remote heap memory disclosures
By sending a truncated ZRTP Ping packet, the response packet will
include several bytes of the affected application's heap memory due to a
lack of validation on the incoming packet. This flaw could be exploited
to gain knowledge about the heap state of an affected application to
enable further attacks, or potentially reveal sensitive information
stored on the heap.
The fixes for all of these flaws were included in the following commit: