GNU Gatekeeper 5.17 release (SECURITY UPDATE)

 I have just released GNU Gatekeeper version 5.17. This is a security
update and you are urged to please update as soon as possible.

Download from https://www.gnugk.org/h323download.html

This release contains about 90 bug fixes, most of them found by
Anthropics OSS-Scanner. Almost all of the bugs are security related,
some critical. There is also an important bug fix for H.460.18 between
neighbors.

Additionally, you should disable unused features in GnuGk to reduce
your attack surface. For example, only enable H.460.17, H.460.23,
H.460.24 and H.460.26 or T.120 if you really use them (which 99% of
users don't).

To help avoid regressions with this large number of fixes, a test
harness has been added to test some common call scenarios, but i
certainly doesn't cover all functionality, so please make sure you do
at least a quick test of the functionality you use after upgrading.

See the full list of changes below.

Regards,
Jan

Changes from 5.16 to 5.17
=========================
- BUGFIX(SoftPBX.cxx) set release source and cause for calls
  disconnected by status port commands
- BUGFIX(ProxyChannel.cxx) fix callSignallingAddress in H.460.18 SCI to
  traversal client neighbor
- BUGFIX(ProxyChannel.cxx) fix memory leak in call rerouting
- BUGFIX(GkStatus.cxx) limit status port command lines to 2K
- BUGFIX(gksql_redis.cxx) implement GkRedisResult::FetchRow(),report
  Redis error replies as query errors
- BUGFIX(GkClient.*) add mutex for aliases
- BUGFIX(GkStatus.cxx) add mutex for libssh sessions
- BUGFIX(gkacct.cxx, gkauth.cxx) fix crash when reloading the config
- BUGFIX(ProxyChannel.cxx) fix race with H.235.6 encryption
- BUGFIX(ProxyChannel.cxx,RasSrv.cxx) fix H.460.17 memory leak
- BUGFIX(*) URL-escaping for HttpAcct, HttpPasswordAuth and HtttRouting
- BUGFIX(GkClient.cxx) check size of H.460.24 probe before reading it
- BUGFIX(ProxyChannel.cxx) better check for H.235.6 key size
- BUGFIX(RasTbl.cxx) fix crash in H.460.9 processing
- BUGFIX(ProxyChannel.cxx) fix socket leak in H.245 multiplexing
- BUGFIX(Routing.cxx) check field types in JSON response of Http policy
- BUGFIX(gksql_*.cxx) fix quoting of SQL commands
- BUGFIX(gksql_*.cxx) fix memory leaks
- BUGFIX(ProxyChannel.cxx, RasTbl.cxx) fix crash for endpoints using
  old GnuGk NAT method
- BUGFIX(ProxyChannel.cxx) never select on or read from a signalling
  socket that is marked deletable
- BUGFIX(ProxyChannel.cxx) avoid port exhaustion by checking error code
- BUGFIX(ProxyChannel.cxx) remove incorrect check that prevented
  CallProceedings from being processed before forwarding
- BUGFIX(ProxyChannel.cxx) never open an H.245 connection to our own
  status port
- BUGFIX(*) apply DisabledCodecs= switch to fastStart, too, fix setting
  them with Radius
- new switch [RoutedMode] EnableT120=0 to remove T.120 capabilities and
  reject T.120 channels (default is 1)
- config check: warn when SimplePasswordAuth tries to check messages an
  enabled authenticator (CAT, MD5) never puts a token into
- BUGFIX(ProxyChannel.cxx) fix IPv4-IPv6 conversion bug when not
  compiled with LARGE_FDSET
- new GnuGk test harness in test/
- BUGFIX(gkauth.cxx) fix AND (&) in AliasAuth/SQLAliasAuth rules
- BUGFIX(gkauth.cxx) match sigaddr rules in AliasAuth/SQLAliasAuth as
  documented in manual
- BUGFIX(ProxyChannel.cxx) ignore H.460.19 RTCP keepAlives when
  collecting RTCP statistics
- BUGFIX(amqpacct.cxx) serialize MQLog() with a mutex
- BUGFIX(ProxyChannel.cxx) check RTCP SDES item length against packet
  size
- BUGFIX(Toolkit.cxx) keep temporary config files in private directory
  (mkdtemp) instead of directly in /tmp
- BUGFIX(radproto.cxx) don't abort pending RADIUS request on an empty
  datagram
- BUGFIX(ProxyChannel.cxx) fix NULL deref handling Sorensen source-info
- BUGFIX(ProxyChannel.cxx) better check for H.245 connection when doing
  TCS0 transfer
- BUGFIX(Toolkit.cxx) null sql connections to avoid double-delete
- BUGFIX(RasTbl.cxx) lock gateway record while matching prefixes
- BUGFIX(ProxyChannel.cxx) fix double-delete in call failover
- BUGFIX(geoip.cxx) IPs without a database record are now country
  'unknown' instead of an empty string
- BUGFIX(h460presence.cxx) fix crash with too long lists
- BUGFIX(h460presence.cxx) fix crash on empty subscription list
- BUGFIX(gksql_firebird.cxx) fix fetching INTs and row count in
  Firebird SQL driver
- BUGFIX(forwarding.cxx) forwarding policy should only look at the
  number of DB results it could actually fetch
- BUGFIX(yasocket.cxx) bind UDP socket exclusive, so other calls can
  detect it is in use
- BUGFIX(RasTbl.*) lock CallRec in more setters and getters
- BUGFIX(RasSrv.cxx) better check for existing aliases on additive
  registrations
- BUGFIX(ProxyChannel.cxx) RTP/RTCP proxy sockets hold own call
  reference to avoid use-after-free on call cleanup
- BUGFIX(ProxyChannel.cxx) fix crash in call rerouting
- BUGFIX(sigmsg.cxx) check IE size before encoding
- BUGFIX(ProxyChannel.cxx) make sure the saved H.460.18 message is
  really a Setup
- BUGFIX(ProxyChannel.cxx) fix crash in H.460.17 endpoint cleanup
- BUGFIX(Routing.cxx) add NULL check in vqueue policy
- BUGFIX(Routing.cxx) make sure we don't skip an alias when DNS policy
  deletes one
- BUGFIX(RasSrv.cxx) avoid crash when dns policy removes all
  destination aliases from ARQ
- BUGFIX(*) remove insecure support for neighbor access tokens, not
  used since GnuGk 2.2
- BUGFIX(*) check ASN.1 array size when adding
- BUGFIX(RasTbl.*) protect access to keep-alive maps with a mutex
- BUGFIX(gkh235.cxx, gkauth.*) fix auth bypass with unknown token OIDs
- BUGFIX(ProxyChannel.cxx) don't crash on H.460.19 OLC without
  mediaControlChannel
- BUGFIX(ldap.cxx, gkauth.cxx, Toolkit.cxx) escape LDAP filter
  characters in aliases for LDAP and H.350 queries
- BUGFIX(ProxyChannel.cxx) reject Setup with a guessed CRV
- BUGFIX(ProxyChannel.cxx, gkauth.cxx) fix type confusion: index into
  array not the array pointer
- BUGFIX(capctrl.*) CapacityControl must consider the CompareAliasCase=
  setting
- BUGFIX(ProxyChannel.cxx) fix cleanup of H.460.19 fastStart channels
- BUGFIX(ProxyChannel.cxx) when accepting H.460.18 traversal clients,
  make sure not to re-assign sockets
- BUGFIX(ProxyChannel.cxx) fix handling of H.460.18 Facility messages
- BUGFIX(ProxyChannel.cxx) fix race condition when opening a T.120
  channel
- BUGFIX(ProxyChannel.cxx) use dynamic_cast in order not to confuse
  T120LogicalChannel with RTPLogicalChannel causing crashes
- BUGFIX(RasTbl.cxx) fix crash on too long language list
- BUGFIX(RasSrv.cxx) only accept QoS reports from registered endpoints
  (H.460.9)
- BUGFIX(authenticators.cxx) OpenSSL 3 fix for DES-ECB
- BUGFIX(ProxyChannel.cxx) block Connect or CallProceeding without a
  call
- BUGFIX(gksql_odbc.cxx) detect if backend needs backslash escaping
- BUGFIX(gkauth.cxx, Routing.cxx, httpacct.cxx) only accept 2xx HTTP
  responses as valid
- BUGFIX(ProxyChannel.*) use correct buffer size when acting as
  encryption proxy
- BUGFIX(RasTbl.cxx) fix round robin routing (crash)
- BUGFIX(ProxyChannel.cxx) ignore fastStart channel after regular
  channels have been established
- BUGFIX(*) safer H.460 parameter handling
- BUGFIX(ProxyChannel.cxx) drop impossibly large TPKT packets
- BUGFIX(RasTbl.*) add copy-ctors for H46019KeepAlive to fix
  use-after-free
- BUGFIX(ProxyChannel.cxx) fix use-after-free in call cleanup
- BUGFIX(RasSrv.cxx) fix use-after-free
- BUGFIX(gksql_redis.cxx, gksql_mysql.cxx) fix resource leak
- BUGFIX(gkh235.cxx, gkauth.cxx, lua.cxx) better guard against empty
  passwords
- BUGFIX(Routing.cxx) never route calls to our own status port

GNU Gatekeeper 5.16 released

 *** This is a security update ***

Download: https://www.gnugk.org/h323download.html

Serveral possibly security related issues have been fixed.

 

Changes from 5.15 to 5.16
=========================
- BUGFIX(ProxyChannel.cxx) better check for tpkt.length
- BUGFIX(ProxyChannel.cxx) avoid OOB memory read in RTCP packets
- BUGFIX(GkClient.cxx) better check of H.460.24 probes

GNU Gatekeeper 5.15 released

 *** This is a security update ***

Download: https://www.gnugk.org/h323download.html

Serveral issues related to authentication features have been fixed.

Besides the security updates, another bug has been fix to respect the InternalNetworks setting when the ExternalIP setting is active.

 

Changes from 5.14 to 5.15
=========================
- BUGFIX(authenticators.cxx) small fixes to H235AuthDesECB and H235AuthDesCTS
- BUGFIX(ipauth.cxx) fix checking prefixes
- BUGFIX(sqlauth.cxx) don't accept empty passwords
- BUGFIX(gkauth.cxx) fix in Q.931 authentication
- BUGFIX(gkauth.cxx) fix auth cache expiry
- disable command execution for port notifications unless the feature is explicitely activated by ./configure --enable-port-notification-exec
- BUGFIX(GkStatus.cxx) improve ssh status port authentication
- BUGFIX(ProxyChannel.cxx) make sure we respect InternalNetworks= when using ExternalIP=

GNU Gatekeeper 5.14 released

 

GNU Gatekeeper version 5.14 has been released.

Download: https://www.gnugk.org/h323download.html

This is mostly a bug fixing release, but it also updates the Amazon AWS IP detection to the current standard.

Changes from 5.13 to 5.14
=========================
- update AWS IP detection to IMDSv2
- BUGFIX(RasTbl.h) fix potential memory leak
- BUGFIX(h323utils.cxx) fix detection of 'site local' and 'unique local' IPv6 addresses
- BUGFIX(Makefile.in) restore compatibility with GCC 4, 5 and 6
- BUGFIX(Toolkit.cxx) restore compatibility with very old versions of OpenSSL
- BUGFIX(h323utils.cxx) fix numeric overflow
- BUGFIX(Toolkit.cxx) fix iterator usage (found by Coverity)
 

 

GNU Gatekeeper 5.13 released

GNU Gatekeeper version 5.13 has been released.

Download: https://www.gnugk.org/h323download.html

This is a bug fix release with a no new features added. It fixes an issue with the RTP port detection and 2 other minor issues.

New release of PTLib

I have just bundeled up the changes and bug fixes of the past 2 years and released PTLib 2.10.9.6.

Most notable in this release is working IPv6 on *BSD, macOSX and Solaris as well as support for newer compilers and many small platform fixes.

Since PTLib is the foundation for the GNU Gatekeeper and many H323Plus projects, all these improvements get propagated into those projects as well.

Changes:
- IPv6 support fixed for *BSD, macOSX and Solaris
- support for newer compiler, eg. gcc 13 and VS2022
- support for C++-17
- support for Win64 builds
- support AIX as platform
- small OpenBSD fixes
- other small fixes

Download from https://www.h323plus.org/source/

GNU Gatekeeper 5.12 released

 GNU Gatekeeper version 5.12 has been released.

Download: https://www.gnugk.org/h323downldad.html

This is a bug fix release with a few new features added.

Another important bug in the handling of the ExternalIP switch has been fixed as well as Y2K38 issues.

This release also adds features:

• support for Oracle databases
• easier cloud deployment with IP detection with STUN
• better load scaling by mixing proxied with direct mode endpoints in a single gatekeeper
• Windows 64bit executables with VS2022

Full list of changes:

• enable more runtime hardening flags from OpenSSF recommendation 11/2023
• fix bug with H.245 address when using ExternalIP= switch without H.460.18/.19
• auto-detect public IP with ExternalIP=STUN and STUNServer=stun.example.com
• compiler support for VS2022
• new database driver for Oracle and new timestamp format 'Oracle'
• new switch [EP::xxx] ForceDirectMode=1 to handle all calls from this endpoint in direct mode
• BUGFIX(RasSrv.cxx, gkauth.cxx) make sure time_t is handled unsigned to avoid Y2K38 issue
• BUGFIX(ProxyChannel.cxx) check for too small packets when acting as encryption proxy