murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or crash) via a message flood.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are     persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or     crash) via a message flood. (CVE-2018-20743)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - murmur in Mumble through 1.2.19 before 2018-08-31 mishandles multiple concurrent requests that are
    persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or
    crash) via a message flood. (CVE-2018-20743)

This update for mumble fixes the following issues :

CVE-2018-20743: murmur mishandled multiple concurrent requests that were persisted in the database, which allowed remote attackers to cause a denial of service (daemon hang or crash) via a message flood.
(boo#1123334)

It was discovered that insufficient restrictions in the connection handling of Mumble, a low latency encrypted VoIP client, could result in denial of service.

It has been found that the mumble-server mishandles multiple concurrent requests that are persisted in the database, which allows remote attackers to cause a denial of service (daemon hang or crash) via a message flood. With the new security update a rate limiter is added with Leaky-Bucket algorithm.

For Debian 8 'Jessie', this problem has been fixed in version 1.2.8-2+deb8u1.

We recommend that you upgrade your mumble packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254596	Linux Distros Unpatched Vulnerability : CVE-2018-20743	Nessus	Misc.	high
405646	Alpine: multiple mumble packages: security update to 1.2.19-r9	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405646	Alpine: multiple mumble packages: security update to 1.2.19-r9	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
405645	Alpine: multiple mumble packages: security update to 1.2.19-r7	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405645	Alpine: multiple mumble packages: security update to 1.2.19-r7	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
405644	Alpine: multiple mumble packages: security update to 1.2.19-r5	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405644	Alpine: multiple mumble packages: security update to 1.2.19-r5	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
405643	Alpine: multiple mumble packages: security update to 1.2.19-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405643	Alpine: multiple mumble packages: security update to 1.2.19-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400590	Alpine: multiple mumble packages: security update to 1.2.19-r8 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400590	Alpine: multiple mumble packages: security update to 1.2.19-r8 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
126978	openSUSE Security Update : mumble (openSUSE-2019-1794)	Nessus	SuSE Local Security Checks	high
122621	Debian DSA-4402-1 : mumble - security update	Nessus	Debian Local Security Checks	high
121624	Debian DLA-1661-1 : mumble security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-20743

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high