« Volver al listado

CVE-2017-14114

Estado: ModificadaMedia (6.5)—

RTPproxy hasta la versión 2.2.alpha.20160822 tiene una característica NAT que resulta en que no se determina correctamente la dirección IP y el número de puerto del destinatario legítimo de tráfico RTP, lo que permite que atacantes remotos obtengan información sensible o provoquen una denegación de servicio (interrupción de la comunicación) mediante paquetes RTP manipulados.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rtpproxy — Rtpproxy

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-14114",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-09-02T16:29:00.363",
  "references": [
    {
      "url": "https://rtpbleed.com",
      "tags": [
        "Press/Media Coverage",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://rtpbleed.com",
      "tags": [
        "Press/Media Coverage",
        "Technical Description",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "RTPproxy through 2.2.alpha.20160822 has a NAT feature that results in not properly determining the IP address and port number of the legitimate recipient of RTP traffic, which allows remote attackers to obtain sensitive information or cause a denial of service (communication outage) via crafted RTP packets."
    },
    {
      "lang": "es",
      "value": "RTPproxy hasta la versión 2.2.alpha.20160822 tiene una característica NAT que resulta en que no se determina correctamente la dirección IP y el número de puerto del destinatario legítimo de tráfico RTP, lo que permite que atacantes remotos obtengan información sensible o provoquen una denegación de servicio (interrupción de la comunicación) mediante paquetes RTP manipulados."
    }
  ],
  "lastModified": "2026-06-17T01:05:37.497",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rtpproxy:rtpproxy:*:alpha.20160822:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4529ABC9-0034-496E-98E9-E21976F96893",
              "versionEndIncluding": "2.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}