CVE-2021-41145 : What You Need to Know

FreeSWITCH prior to version 1.10.7 is vulnerable to Denial of Service (DoS) through SIP flooding, enabling attackers to crash instances. This article details the impact, technical aspects, and mitigation strategies for CVE-2021-41145.

Understanding CVE-2021-41145

FreeSWITCH's vulnerability to Denial of Service via SIP flooding.

What is CVE-2021-41145?

FreeSWITCH is a Software Defined Telecom Stack allowing a transition to software-based telecom solutions.
Vulnerability: DoS via SIP flooding, causing memory exhaustion and instance crashes.

The Impact of CVE-2021-41145

CVSS Score: 8.6 (High)
Attack Vector: Network
Availability Impact: High
Attackers can crash FreeSWITCH instances through flooding without authentication over UDP, TCP, or TLS.
Patched in version 1.10.7.

Technical Details of CVE-2021-41145

Details of the vulnerability.

Vulnerability Description

Vulnerability Type: Uncontrolled Resource Consumption (CWE-400)
Attack Complexity: Low
Scope: Changed

Affected Systems and Versions

Product: FreeSWITCH
Vendor: SignalWire
Versions Affected: < 1.10.7

Exploitation Mechanism

Attacker floods FreeSWITCH with SIP messages, causing memory exhaustion and process termination.

Mitigation and Prevention

Protective measures against CVE-2021-41145.

Immediate Steps to Take

Update FreeSWITCH to version 1.10.7 immediately.
Monitor system resources for unusual activity.
Implement rate limiting for incoming SIP traffic.

Long-Term Security Practices

Regularly update and patch FreeSWITCH to mitigate future vulnerabilities.
Conduct security audits of FreeSWITCH deployments.

Patching and Updates

Ensure all FreeSWITCH instances are updated to version 1.10.7 to address the DoS vulnerability.