Executive Summary

This vulnerability exists in Coturn versions prior to 4.10.0, which is an open source TURN and STUN server implementation. It is a stack buffer overflow in the function decode_oauth_token_gcm(). Specifically, a 16-bit nonce length field (nonce_len) is read from an attacker-supplied OAuth access token and used directly as the length parameter in a memcpy() call to copy data into a fixed 256-byte stack buffer without any bounds checking.

Because the nonce_len can be up to 65535, this allows an attacker to write up to 735 bytes beyond the buffer, corrupting adjacent stack data including control-flow data. This overflow happens before AES-GCM authentication is verified, so the attacker does not need to know the OAuth key or produce a valid token. The vulnerability requires the --oauth mode to be enabled, which is not the default.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker to perform a stack buffer overflow that may corrupt control-flow data on the stack. This can potentially lead to remote code execution (RCE) depending on the presence of exploit mitigations, compiler, and ABI specifics.

Since Coturn is widely deployed for WebRTC TURN/STUN services and the --oauth mode is commonly recommended, the impact can be broad. An attacker could exploit this vulnerability remotely without authentication or knowledge of the OAuth key, leading to full compromise of the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade Coturn to version 4.10.0 or later, where the issue has been fixed.

Additionally, if you are using the --oauth mode (which is required for this vulnerability to be exploitable), consider disabling it temporarily until you can upgrade.

Useful 0 Not Useful 0