CVE-2014-3513

What it actually does

Memory leak in DTLS SRTP extension processing allows remote unauthenticated attackers to trigger unbounded memory allocation via crafted handshake messages, leading to denial of service through resource exhaustion.

Why it matters to the business

Applications relying on DTLS SRTP (such as certain VoIP or secure media services) can experience service degradation or outages from memory consumption, increasing operational costs and risking availability for users of affected Firefox and Thunderbird packages on Ubuntu 14.04 LTS.

How an attack unfolds

An attacker crafts malicious DTLS handshake messages that exercise the SRTP extension code path in d1_srtp.c, repeatedly sending them to cause progressive memory leaks until the process is exhausted or killed.

How to fix it

Upgrade affected packages to the fixed versions: firefox to 34.0+build2-0ubuntu0.14.04.1 and thunderbird to 1:31.3.0+build1-0ubuntu0.14.04.1 on Ubuntu 14.04 LTS; apply equivalent OpenSSL updates if using custom builds.

How to confirm the fix worked

Verify installed package versions match or exceed the listed fixed releases; perform regression testing with DTLS SRTP handshake tools to confirm memory stability under crafted input.

Typical attack path

1. Identify target systems exposing DTLS SRTP endpoints
2. Craft and transmit malformed handshake messages exploiting the SRTP extension
3. Monitor for memory growth on the target
4. Repeat to amplify consumption until denial of service occurs

How to detect it

Review system logs and process monitoring for unexplained memory growth coinciding with DTLS traffic; inspect network captures for repeated anomalous handshake messages targeting the SRTP extension.

What your security team should do

• Prioritize patching of all Ubuntu 14.04 LTS systems running the listed Firefox and Thunderbird packages
• Monitor EPSS score trajectory and reassess exposure if new exploit code appears
• Disable DTLS SRTP where not required as a temporary control