CVE-2023-51443 : Security Advisory and Response

FreeSWITCH is susceptible to Denial of Service via DTLS Hello packets during call initiation.

Understanding CVE-2023-51443

FreeSWITCH prior to version 1.10.11 is vulnerable to a Denial of Service attack due to a race condition in the hello handshake phase of the DTLS protocol.

What is CVE-2023-51443?

FreeSWITCH, a Software Defined Telecom Stack, faces a Denial of Service risk during media setup with DTLS-SRTP due to a race condition in the hello handshake phase of the DTLS protocol.

The Impact of CVE-2023-51443

Exploiting this vulnerability can lead to a massive Denial of Service on FreeSWITCH servers relying on DTLS-SRTP for calls, by continuously generating a DTLS error during call initiation.

Technical Details of CVE-2023-51443

This section outlines the specific technical details of the vulnerability.

Vulnerability Description

An attacker can perform a DoS attack by sending a ClientHello DTLS message with an invalid CipherSuite to the FreeSWITCH server, resulting in tearing down media and signaling sessions.

Affected Systems and Versions

Vendor: SignalWire
Product: FreeSWITCH
Affected Versions: < 1.10.11

Exploitation Mechanism

By leveraging a race condition in the DTLS hello handshake phase, an attacker can continuously disrupt DTLS-SRTP encrypted call initiation.

Mitigation and Prevention

To address CVE-2023-51443, immediate actions and long-term security practices are essential.

Immediate Steps to Take

Upgrade FreeSWITCH to version 1.10.11 to apply the security fix and prevent the vulnerability exploitation. Dropping all packets from unvalidated addresses can also mitigate the risk.

Long-Term Security Practices

Regularly update and patch FreeSWITCH to ensure the latest security features and fixes are in place. Implement strong network security measures to detect and prevent DoS attacks.

Patching and Updates

Stay informed about security advisories and updates from SignalWire to protect FreeSWITCH against potential vulnerabilities.