This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Digium First view 2007-10-12
Product Asterisk Last view 2021-03-05
Version 1.4.11 Type Application
Update *  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:digium:asterisk

Activity : Overall

Related : CVE

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
6.5 2021-03-05 CVE-2019-18351

An issue was discovered in channels/chan_sip.c in Sangoma Asterisk through 13.29.1, through 16.6.1, and through 17.0.0; and Certified Asterisk through 13.21-cert4. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.

6.5 2021-02-19 CVE-2021-26713

A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession. This is caused by a signedness comparison mismatch.

5.9 2021-02-18 CVE-2021-26906

An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.

7.5 2021-02-18 CVE-2021-26717

An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash.

7.5 2021-02-18 CVE-2021-26712

Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets.

6.5 2021-02-18 CVE-2020-35776

A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses.

6.5 2021-01-29 CVE-2020-35652

An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1.0. A crash can occur when a SIP message is received with a History-Info header that contains a tel-uri, or when a SIP 181 response is received that contains a tel-uri in the Diversion header.

7.5 2019-11-22 CVE-2019-18976

An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.

6.5 2019-11-22 CVE-2019-18790

An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x, 16.x, and 17.x, and Certified Asterisk 13.21, because of an incomplete fix for CVE-2019-18351. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.

8.8 2019-11-22 CVE-2019-18610

An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.

7.5 2019-09-09 CVE-2019-15639

main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario.

6.5 2019-09-09 CVE-2019-15297

res_pjsip_t38 in Sangoma Asterisk 13.21-cert4, 15.7.3, and 16.5.0 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk.

5.3 2019-07-12 CVE-2019-13161

An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).

6.5 2019-07-12 CVE-2019-12827

Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.

6.5 2019-03-28 CVE-2019-7251

An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation.

7.5 2018-09-24 CVE-2018-17281

There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.

5.3 2018-06-12 CVE-2018-12227

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints.

6.5 2018-02-21 CVE-2018-7286

An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection.

7.5 2018-02-21 CVE-2018-7285

A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1. The RTP support in Asterisk maintains its own registry of dynamic codecs and desired payload numbers. While an SDP negotiation may result in a codec using a different payload number, these desired ones are still stored internally. When an RTP packet was received, this registry would be consulted if the payload number was not found in the negotiated SDP. This registry was incorrectly consulted for all packets, even those which are dynamic. If the payload number resulted in a codec of a different type than the RTP stream (for example, the payload number resulted in a video codec but the stream carried audio), a crash could occur if no stream of that type had been negotiated. This was due to the code incorrectly assuming that a stream of that type would always exist.

7.5 2018-02-21 CVE-2018-7284

A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.

7.5 2017-12-27 CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel driver was used, Asterisk would crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled, a user would have to first be authorized before reaching the crash point.

5.9 2017-12-13 CVE-2017-17664

A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack.

7.5 2017-12-01 CVE-2017-17090

An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 and older. If the chan_skinny (aka SCCP protocol) channel driver is flooded with certain requests, it can cause the asterisk process to use excessive amounts of virtual memory, eventually causing asterisk to stop processing requests of any kind.

5.9 2017-11-08 CVE-2017-16672

An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash.

8.8 2017-11-08 CVE-2017-16671

A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer.

CWE : Common Weakness Enumeration

%idName
21% (9) CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
14% (6) CWE-20 Improper Input Validation
9% (4) CWE-476 NULL Pointer Dereference
9% (4) CWE-264 Permissions, Privileges, and Access Controls
9% (4) CWE-200 Information Exposure
4% (2) CWE-787 Out-of-bounds Write
4% (2) CWE-399 Resource Management Errors
4% (2) CWE-89 Improper Sanitization of Special Elements used in an SQL Command ('...
2% (1) CWE-772 Missing Release of Resource after Effective Lifetime
2% (1) CWE-732 Incorrect Permission Assignment for Critical Resource
2% (1) CWE-459 Incomplete Cleanup
2% (1) CWE-404 Improper Resource Shutdown or Release
2% (1) CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
2% (1) CWE-190 Integer Overflow or Wraparound
2% (1) CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflo...
2% (1) CWE-16 Configuration

Open Source Vulnerability Database (OSVDB)

id Description
77597 Asterisk Request Response Port SIP Peer Enumeration
74352 Asterisk SIP Channel Driver Default Configuration Invalid SIP Request Usernam...
73434 Asterisk Multiple Products Manager Interface manager.c Originate Action Remot...
73433 Asterisk Multiple Products Unauthenticated Session Connection Saturation Remo...
73309 Asterisk channels/chan_iax2.c iax2_setoption() Function Invalid Pointer DoS
73257 Asterisk SIP Multiple Message Response Username Enumeration
70968 Asterisk main/udptl.c Multiple Function UPDTL Packet Handling Overflow
70518 Asterisk main/utils.c ast_uri_encode() Function Caller ID Information Overflow
62451 Asterisk Dialplan Wildcard Pattern Configuration Manipulation
60569 Asterisk rtp.c RTP Comfort Noise Payload Remote DoS
59697 Asterisk SIP REGISTER Response Username Enumeration Weakness
38933 Asterisk Postgres Realtime Engine SQL Injection
38932 Asterisk Call Detail Record Postgres Multiple Strings SQL Injection
38202 Asterisk IMAP Voicemail Backend Crafted Fields Local Overflow
38201 Asterisk IMAP Voicemail Backend Crafted Content Header Remote Overflow

OpenVAS Exploits

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2012-08-30 Name : Fedora Update for asterisk FEDORA-2012-4230
File : nvt/gb_fedora_2012_4230_asterisk_fc17.nasl
2012-08-30 Name : Fedora Update for asterisk FEDORA-2012-6704
File : nvt/gb_fedora_2012_6704_asterisk_fc17.nasl
2012-08-10 Name : Debian Security Advisory DSA 2493-1 (asterisk)
File : nvt/deb_2493_1.nasl
2012-05-04 Name : Fedora Update for asterisk FEDORA-2012-6612
File : nvt/gb_fedora_2012_6612_asterisk_fc16.nasl
2012-04-30 Name : Gentoo Security Advisory GLSA 201203-21 (Asterisk)
File : nvt/glsa_201203_21.nasl
2012-04-30 Name : Debian Security Advisory DSA 2460-1 (asterisk)
File : nvt/deb_2460_1.nasl
2012-04-02 Name : Fedora Update for asterisk FEDORA-2012-4318
File : nvt/gb_fedora_2012_4318_asterisk_fc16.nasl
2012-04-02 Name : Fedora Update for asterisk FEDORA-2012-4259
File : nvt/gb_fedora_2012_4259_asterisk_fc15.nasl
2012-02-12 Name : Gentoo Security Advisory GLSA 201110-21 (Asterisk)
File : nvt/glsa_201110_21.nasl
2012-02-11 Name : Debian Security Advisory DSA 2367-1 (asterisk)
File : nvt/deb_2367_1.nasl
2011-08-03 Name : Debian Security Advisory DSA 2276-2 (asterisk)
File : nvt/deb_2276_2.nasl
2011-08-03 Name : Debian Security Advisory DSA 2276-1 (asterisk)
File : nvt/deb_2276_1.nasl
2011-08-03 Name : FreeBSD Ports: asterisk14
File : nvt/freebsd_asterisk142.nasl
2011-07-18 Name : Fedora Update for asterisk FEDORA-2011-8914
File : nvt/gb_fedora_2011_8914_asterisk_fc14.nasl
2011-05-17 Name : Fedora Update for asterisk FEDORA-2011-6225
File : nvt/gb_fedora_2011_6225_asterisk_fc14.nasl
2011-05-12 Name : FreeBSD Ports: asterisk14
File : nvt/freebsd_asterisk141.nasl
2011-05-12 Name : Debian Security Advisory DSA 2225-1 (asterisk)
File : nvt/deb_2225_1.nasl
2011-05-10 Name : Fedora Update for asterisk FEDORA-2011-6208
File : nvt/gb_fedora_2011_6208_asterisk_fc13.nasl
2011-03-15 Name : Fedora Update for asterisk FEDORA-2011-2438
File : nvt/gb_fedora_2011_2438_asterisk_fc14.nasl
2011-03-15 Name : Fedora Update for asterisk FEDORA-2011-2558
File : nvt/gb_fedora_2011_2558_asterisk_fc13.nasl
2011-03-09 Name : Gentoo Security Advisory GLSA 201006-20 (asterisk)
File : nvt/glsa_201006_20.nasl
2011-03-09 Name : Debian Security Advisory DSA 2171-1 (asterisk)
File : nvt/deb_2171_1.nasl
2011-03-05 Name : FreeBSD Ports: asterisk14
File : nvt/freebsd_asterisk140.nasl
2011-02-04 Name : Fedora Update for asterisk FEDORA-2011-0774
File : nvt/gb_fedora_2011_0774_asterisk_fc14.nasl
2011-02-04 Name : Fedora Update for asterisk FEDORA-2011-0794
File : nvt/gb_fedora_2011_0794_asterisk_fc13.nasl

Information Assurance Vulnerability Management (IAVM)

id Description
2014-A-0085 Multiple Vulnerabilities in Asterisk Products
Severity: Category I - VMSKEY: V0052633

Snort® IPS/IDS

Date Description
2020-05-07 Asterisk Manager Interface Originate action arbitrary command execution attempt
RuleID : 53579 - Type : PROTOCOL-VOIP - Revision : 1
2019-09-19 Digium Asterisk multiple malformed Accept headers denial of service attempt
RuleID : 51087 - Type : PROTOCOL-VOIP - Revision : 1
2019-09-19 Digium Asterisk multiple malformed Accept headers denial of service attempt
RuleID : 51086 - Type : PROTOCOL-VOIP - Revision : 1
2014-01-10 Digium Asterisk oversized Content-Length memory corruption attempt
RuleID : 25276 - Type : SERVER-OTHER - Revision : 5
2014-01-10 Digium Asterisk RTP comfort noise denial of service attempt
RuleID : 24270 - Type : PROTOCOL-VOIP - Revision : 3
2014-01-10 Digium Asterisk UDPTL processing overflow attempt
RuleID : 19167 - Type : PROTOCOL-VOIP - Revision : 10

Nessus® Vulnerability Scanner

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2018-11-26 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201811-11.nasl - Type: ACT_GATHER_INFO
2018-10-17 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4320.nasl - Type: ACT_GATHER_INFO
2018-09-28 Name: The remote Debian host is missing a security update.
File: debian_DLA-1523.nasl - Type: ACT_GATHER_INFO
2018-09-27 Name: A telephony application running on the remote host is affected by a remote de...
File: asterisk_ast_2018_009.nasl - Type: ACT_GATHER_INFO
2018-09-24 Name: The remote FreeBSD host is missing one or more security-related updates.
File: freebsd_pkg_77f67b46bd7511e881b6001999f8d30b.nasl - Type: ACT_GATHER_INFO
2018-06-15 Name: A telephony application running on the remote host is affected by a remote de...
File: asterisk_ast_2018_008.nasl - Type: ACT_GATHER_INFO
2018-06-15 Name: A telephony application running on the remote host is affected by multiple vu...
File: asterisk_ast_15_x_2018_007-008.nasl - Type: ACT_GATHER_INFO
2018-03-02 Name: A telephony application running on the remote host is affected by multiple vu...
File: asterisk_ast_2018_001-006.nasl - Type: ACT_GATHER_INFO
2018-03-02 Name: A telephony application running on the remote host is affected by a Subscribe...
File: asterisk_ast_2018_002-005.nasl - Type: ACT_GATHER_INFO
2018-02-23 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_933654ce17b811e890b8001999f8d30b.nasl - Type: ACT_GATHER_INFO
2018-01-15 Name: The remote Fedora host is missing a security update.
File: fedora_2017-41242dfe10.nasl - Type: ACT_GATHER_INFO
2018-01-15 Name: The remote Fedora host is missing a security update.
File: fedora_2017-66e9367f7e.nasl - Type: ACT_GATHER_INFO
2018-01-04 Name: A telephony application running on the remote host is affected by a remote de...
File: asterisk_ast_2017_014.nasl - Type: ACT_GATHER_INFO
2018-01-02 Name: The remote Debian host is missing a security update.
File: debian_DLA-1225.nasl - Type: ACT_GATHER_INFO
2018-01-02 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4076.nasl - Type: ACT_GATHER_INFO
2017-12-28 Name: The remote Fedora host is missing a security update.
File: fedora_2017-38fbcdffc3.nasl - Type: ACT_GATHER_INFO
2017-12-26 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_2a3bc6ace7c611e7a90b001999f8d30b.nasl - Type: ACT_GATHER_INFO
2017-12-06 Name: A telephony application running on the remote host is affected by a memory ex...
File: asterisk_ast_2017_013.nasl - Type: ACT_GATHER_INFO
2017-12-04 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_e91cf90cd6dd11e79d10001999f8d30b.nasl - Type: ACT_GATHER_INFO
2017-11-17 Name: A telephony application running on the remote host is affected by multiple vu...
File: asterisk_ast_2017_009-011.nasl - Type: ACT_GATHER_INFO
2017-11-10 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_be261737c53511e78da5001999f8d30b.nasl - Type: ACT_GATHER_INFO
2017-11-10 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_ab04cb0bc53311e78da5001999f8d30b.nasl - Type: ACT_GATHER_INFO
2016-05-04 Name: The remote Debian host is missing a security update.
File: debian_DLA-455.nasl - Type: ACT_GATHER_INFO
2014-12-29 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201412-51.nasl - Type: ACT_GATHER_INFO
2014-11-25 Name: A telephony application running on the remote host is affected by a privilege...
File: asterisk_ast_2014_017.nasl - Type: ACT_GATHER_INFO