Erlang/OTP Megaco Flex Scanner Buffer Overflow Vulnerability (CVE-2024-56250) Analysis

Vulnerability Overview Vulnerability Name: Megaco Flex Scanner Buffer Overflow via Oversized Property Parm Name Vulnerability Description: A remote unauthenticated attacker can cause an Erlang node running the Erlang text codec to crash by sending a single text-encoded H.248/Megaco message containing an excessively long property parameter name (exceeding 452 bytes). The vulnerability resides in a C-linked driver, leading to the termination of the entire BEAM VM process. In OTP 27 and later versions, the overflow may enable code execution unless the operating system or distribution has independently enabled . Affected Versions Affected Versions: - OTP: >= 17.0 - megaco (otp): >= 5.17.1 Fixed Versions: - OTP: 29.0.4, 28.5.0.4, 27.3.4.15 - megaco (otp): 4.9.1, 4.8.3.1, 4.7.2.2 Vulnerability Conditions: - The megaco application must be configured to use the flex scanner ( ). - The megaco transport port must be accessible to the attacker. Remediation Workarounds: - Replace the flex scanner with an Erlang-based scanner (remove from the encoder configuration). Although this incurs higher performance costs, it is not susceptible to C-level memory corruption. - Restrict network access to the megaco transport port, allowing only trusted signaling peers (via firewall/ACL). Additional Information CVSS Score: 8.3/10 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVE ID: CVE-2024-56250 Weaknesses: - CWE-120 - CWE-787 Acknowledgements Thanks to Jonathan Männchen for discovering and responsibly disclosing this vulnerability in the Erlang ecosystem to the Erlang/OTP project via the Erlang Ecosystem Foundation (EEF).

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP Megaco Flex Scanner Buffer Overflow Vulnerability (CVE-2024-56250) Analysis

More from this source