CVE-2021-41145

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. FreeSWITCH prior to version 1.10.7 is susceptible to Denial of Service via SIP flooding. When flooding FreeSWITCH with SIP messages, it was observed that after a number of seconds the process was killed by the operating system due to memory exhaustion. By abusing this vulnerability, an attacker is able to crash any FreeSWITCH instance by flooding it with SIP messages, leading to Denial of Service. The attack does not require authentication and can be carried out over UDP, TCP or TLS. This issue was patched in version 1.10.7.

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. FreeSWITCH prior to version 1.10.7 is susceptible to Denial of Service via SIP flooding. When flooding FreeSWITCH with SIP messages, it was observed that after a number of seconds the process was killed by the operating system due to memory exhaustion. By abusing this vulnerability, an attacker is able to crash any FreeSWITCH instance by flooding it with SIP messages, leading to Denial of Service. The attack does not require authentication and can be carried out over UDP, TCP or TLS. This issue was patched in version 1.10.7.

FreeSWITCH es una pila de telecomunicaciones definida por software que permite la transformación digital de los conmutadores de telecomunicaciones propietarios a una implementación de software que se ejecuta en cualquier hardware básico. FreeSWITCH antes de la versión 1.10.7 es susceptible de denegación de servicio a través de la inundación SIP. Al inundar FreeSWITCH con mensajes SIP, se observó que después de un número de segundos el proceso era matado por el sistema operativo debido al agotamiento de la memoria. Abusando de esta vulnerabilidad, un atacante es capaz de colapsar cualquier instancia de FreeSWITCH inundándola con mensajes SIP, lo que lleva a una denegación de servicio. El ataque no requiere autenticación y puede llevarse a cabo a través de UDP, TCP o TLS. Este problema fue parcheado en la versión 1.10.7