Vidyo Server Security Update 20 (SU20) provides existing WebRTC 3.2 servers with updated packages and package configurations to address most known and current vulnerabilities (CVEs) at the time of the release of this Update, as noted in common OS and package security bulletins.

The updates and configuration changes applied by SU20 are outlined in this article below. 

 

Important Notices

• This update is applicable to all maintained Vidyo servers. For more information, please refer to the Vidyo Software Maintenance Policy.

 

Security Update 20 Files 

This SU20 file...	Is for...
vidyo-webrtc-3.2.2.0010-FF58P-bundle- v1175.vidyo	VidyoWebRTC Server version 3.2.2

 

 

System Changes Performed by Security Update 20

Important Security Changes

As a security improvement, SU20 disables the advertising of the version banner of the TURN server.  To do this, SU20 deprecates support of TLS 1.0 and TLS 1.1 on the HTTPS web interface and the TURN TLS interface. After this update, the Vidyo WebRTC server will advertise TLS 1.2 only over HTTPS enabled interfaces as well as TURN TLS.

Specific security-related package updates:

Java
Product	Previous Version	SU20 Version
Vidyo WebRTC	JRE 1.8 Update 144	JRE 1.8 Update 181

 

 

Apache Web Server
Product	Previous Version	SU20 Version
Vidyo WebRTC	2.4.27 with OpenSSL 1.0.2k	2.4.35 with OpenSSL 1.0.2p

  

Apache Tomcat
Product	Previous Version	SU20 Version
Vidyo WebRTC	8.0.47	8.0.53

  

OpenSSL Dynamic Library
Product	Previous Version	SU20 Version
Vidyo WebRTC	OpenSSL 1.0.2k	OpenSSL 1.0.2p

  

Cotum
Product	Previous Version	SU20 Version
Vidyo WebRTC	4.5.0.6	4.5.0.7

  

NodeJS
Product	Previous Version	SU20 Version
Vidyo WebRTC	6.11.2	6.14.3

  

OpenSSH
Product	Previous Version	SU20 Version
Vidyo WebRTC	7.5p1 (OpenSSL 1.0.2k)	7.8p1 (OpenSSL 1.0.2p)

 

OpenSSH Security Improvements

• Devices are now configured to time out after 60 seconds for incomplete or broken SSH sessions by setting LoginGraceTime to 60 seconds.
• Addresses a security scan issue “Diffie-Hellman group smaller than 2048 bits (tls-dh-prime-under-2048-bits)” by removing groups lower than 2048 bits from /etc/ssh/moduli.
• Adds the following cipher, HMAC. and exchange algorithm lines to the sshd_config.default to strengthen SSH encryption:
  • aes128-ctr,aes192-ctr,aes256-ctr
  • hmac-sha2-256,hmac-sha2-512
  • ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256

These improvements require an SSH client that supports the above listed ciphers, HMACs, and key exchange algorithms. SSH clients that do not support these mechanisms will not be able to connect. Most modern updated SSH clients usually support these mechanisms.

Linux® Kernel Update

• SU20 will update the Linux Kernel to 4.14.57

 

Known Issues after Successfully Applying Security Update 20

Some vulnerability scanners may report a low to moderate level vulnerability of “TCP timestamp response (generic-tcp-timestamp)” and/or “ICMP timestamp response”, even after Security Update 20 is successfully applied.

Description: The remote host responded with a TCP timestamp. The TCP timestamp response can be used to approximate the remote host's uptime, potentially aiding in further attacks. Additionally, some operating systems can be fingerprinted based on the behavior of their TCP timestamps. At this time, Vidyo is reluctant to disable tcp_timestamps, as this could disrupt the packet communication needs of the protocols used for VidyoConferencing. Vidyo considers this vulnerability to be low, and this issue does not really affect the security of the Linux TCP stack in any meaningful way. ICMP may be blocked via a firewall to mitigate the ICMP specific tcp_timestamp issue.

 

Applying Security Update 20

If you have an on-premises VidyoWebRTC Server, you must perform the steps in this section to apply SU20. If you are a cloud customer, you can skip this section because Vidyo will perform the update for you.

VidyoWebRTC Server

To apply Security Update 20 for On-Premises: 

1. Log in to the Vidyo WebRTC Admin Configuration page: http://{Server IP or FQDN}.
   
   
2. Click the Maintenance > Upgrade link. 
   
   
3. Click Choose File. 
   
   
4. Select and open the the vidyo-webrtc-3.2.2.0010-FF58P-bundle-v1175.vidyo file.
   
   
5. Click Upgrade and Reboot on the Maintenance page. 
   The system will reboot after uploading the update package. 
   
   
6. See Contacting Technical Support below for more information about getting assistance.
   
   
7. Repeat steps 1 through 6 for each Vidyo WebRTC Server with the system.
   
   
8. Test that each Vidyo WebRTC Server is functional.

 

Contacting Technical Support

If you are a Vidyo Reseller or Vidyo End User with “Plus” coverage, please feel free to contact the Vidyo Customer Support team via email with any questions or if you need assistance.

• Phone: +1-866-99-VIDYO / +1-201-289-8597
• Email: support@vidyo.com

If you are a Vidyo End User without “Plus” coverage, please contact your Vidyo Reseller for further details.