CVE-2020-4067: 
NixOS vulnerability analysis and mitigation

CVE-2020-4067 affects coturn versions before 4.5.1.3, where there is an issue with STUN/TURN response buffer not being initialized properly. The vulnerability was discovered and reported by Felix Dörre and was disclosed in June 2020. The affected software, coturn, is a VoIP media traffic NAT traversal server and gateway that implements TURN and STUN protocols (GitHub Advisory).

The vulnerability stems from the STUN/TURN response buffer not being properly initialized. When a turn answer requires padding, coturn does not set the padding explicitly to zero bytes, but instead sends the data that was previously in the send buffer. The buffers are shared between clients/connections, leading to potential information leakage (GitHub Advisory).

This vulnerability results in a leak of information between different client connections. An attacker could use their connection to intelligently query coturn to get interesting bytes in the padding bytes from the connection of another client. This impacts the entire coturn and WebRTC community (GitHub Advisory, Ubuntu Notice).

The vulnerability can be exploited by an attacker who has a connection to the coturn server. The attacker can use their connection to intelligently query the server and obtain sensitive information from other clients' connections (Debian LTS).

The vulnerability was fixed in coturn version 4.5.1.3 by properly initializing the stun buffer to zero, both when newly allocated and when reused. There are no known workarounds for this vulnerability, and users are advised to upgrade to the patched version (GitHub Advisory, Fedora Update).