Alta Aware —1564 Multiple DoS vulnerabilities via the pion/srtp, pion/sctp, pion/datachannel and pion/rtp Go packages

Release Date

11th of November 2024.

Overview

Multiple vulnerabilities were discovered in our usage of the pion/srtp, pion/sctp, pion/datachannel and pion/rtp packages which could cause DoS conditions in Alta Video Aware, Alta Video Cloud Connectors, or Alta Video Cameras.

Affected Products

Alta Video:
- All Stable upgrade channel versions before 7.0.8.
- All Beta upgrade channel versions before 7.0.0.
Avigilon Cloud-Native Cameras:
- All Stable upgrade Channel versions before 7.0.8.
- All Beta upgrade channel versions before 7.0.0.
Alta Video Cloud: before DDth Month YYYY.

Unaffected Products

Alta Video:
- All Stable upgrade channel versions after and including 7.0.8.
- All Beta upgrade channel versions after and including 7.0.0.
Avigilon Cloud-Native Cameras:
- All Stable upgrade channel versions after and including 7.0.8.
- All Beta upgrade channel versions after and including 7.0.0.
Alta Video Cloud: from DDth Month YYYY

Resolution

This issue has been fixed in Alta Video Beta upgrade channel version 7.0.0 and Stable upgrade channel version 7.0.8.

It is strongly recommended that all installations running an affected version are upgraded to the latest release as soon as possible. Releases are available to download through the Alta Video User Interface.

A fix was deployed to the Alta Video Cloud on DDth Month YYYY. Alta Video Cloud customers do not need to take any additional action.

This issue has been fixed in Avigilon Cloud-Native Cameras Beta upgrade channel version 7.0.0 and Stable upgrade channel version 7.0.8.

It is strongly recommended that all Avigilon Cloud-Native camera installations running an affected version upgrade to the latest release as soon as possible. Releases are available to download through the Alta Video User Interface for Avigilon Cloud-Native cameras and the Avigilon Cloud-Native Camera Interface for unmanaged cameras.

Vulnerability Information

CVSSv3 score: 6.5 (Medium)
CVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Mitigations

There are no known mitigations for this issue.

Work arounds

There are no known work arounds for this issue.

Acknowledgements

Issue discovered internaly by Avigilon Alta Video.

Disclosure Timeline

24/06/2024 Issue found
24/06/2024 Root cause established
24/06/2024 Fix identified
02/07/2024 Patched Alta Video (Beta upgrade channel) released
27/08/2024 Patched Alta Video (Stable upgrade channel) released
02/07/2024 Patched Avigilon Cloud-Native Cameras (Beta upgrade channel) released
27/08/2024 Patched Avigilon Cloud-Native Cameras (Stable upgrade channel) released
11/11/2024 Vulnerability publicly disclosed