This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Digium First view 2012-06-02
Product Asterisk Last view 2022-08-30
Version 1.8.12.0 Type Application
Update rc3  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:digium:asterisk

Activity : Overall

Related : CVE

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
6.5 2022-08-30 CVE-2021-46837

res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x before 17.9.3, and 18.x before 18.2.2, and Certified Asterisk before 16.8-cert7, allows an attacker to trigger a crash by sending an m=image line and zero port in a response to a T.38 re-invite initiated by Asterisk. This is a re-occurrence of the CVE-2019-15297 symptoms but not for exactly the same reason. The crash occurs because there is an append operation relative to the active topology, but this should instead be a replace operation.

9.8 2022-04-15 CVE-2022-26651

An issue was discovered in Asterisk through 19.x and Certified Asterisk through 16.8-cert13. The func_odbc module provides possibly inadequate escaping functionality for backslash characters in SQL queries, resulting in user-provided data creating a broken SQL query or possibly a SQL injection. This is fixed in 16.25.2, 18.11.2, and 19.3.2, and 16.8-cert14.

9.1 2022-04-15 CVE-2022-26499

An SSRF issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it's possible to send arbitrary requests (such as GET) to interfaces such as localhost by using the Identity header. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

7.5 2022-04-15 CVE-2022-26498

An issue was discovered in Asterisk through 19.x. When using STIR/SHAKEN, it is possible to download files that are not certificates. These files could be much larger than what one would expect to download, leading to Resource Exhaustion. This is fixed in 16.25.2, 18.11.2, and 19.3.2.

7.5 2021-07-30 CVE-2021-32558

An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.

6.5 2021-02-19 CVE-2021-26713

A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession. This is caused by a signedness comparison mismatch.

5.9 2021-02-18 CVE-2021-26906

An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure.

7.5 2021-02-18 CVE-2021-26717

An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash.

7.5 2021-02-18 CVE-2021-26712

Incorrect access controls in res_srtp.c in Sangoma Asterisk 13.38.1, 16.16.0, 17.9.1, and 18.2.0 and Certified Asterisk 16.8-cert5 allow a remote unauthenticated attacker to prematurely terminate secure calls by replaying SRTP packets.

6.5 2021-02-18 CVE-2020-35776

A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses.

6.5 2021-01-29 CVE-2020-35652

An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1.0. A crash can occur when a SIP message is received with a History-Info header that contains a tel-uri, or when a SIP 181 response is received that contains a tel-uri in the Diversion header.

7.5 2019-11-22 CVE-2019-18976

An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940.

6.5 2019-11-22 CVE-2019-18790

An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.

8.8 2019-11-22 CVE-2019-18610

An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.

7.5 2019-09-09 CVE-2019-15639

main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario.

6.5 2019-09-09 CVE-2019-15297

res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash occurs because of a NULL session media object dereference.

5.3 2019-07-12 CVE-2019-13161

An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).

6.5 2019-07-12 CVE-2019-12827

Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0 and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE message.

6.5 2019-03-28 CVE-2019-7251

An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation.

7.5 2018-09-24 CVE-2018-17281

There is a stack consumption vulnerability in the res_http_websocket.so module of Asterisk through 13.23.0, 14.7.x through 14.7.7, and 15.x through 15.6.0 and Certified Asterisk through 13.21-cert2. It allows an attacker to crash Asterisk via a specially crafted HTTP request to upgrade the connection to a websocket.

5.3 2018-06-12 CVE-2018-12227

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However, if an endpoint is not identified, then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot be bypassed to gain access to the disclosed endpoints.

6.5 2018-02-21 CVE-2018-7286

An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection.

7.5 2018-02-21 CVE-2018-7285

A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1. The RTP support in Asterisk maintains its own registry of dynamic codecs and desired payload numbers. While an SDP negotiation may result in a codec using a different payload number, these desired ones are still stored internally. When an RTP packet was received, this registry would be consulted if the payload number was not found in the negotiated SDP. This registry was incorrectly consulted for all packets, even those which are dynamic. If the payload number resulted in a codec of a different type than the RTP stream (for example, the payload number resulted in a video codec but the stream carried audio), a crash could occur if no stream of that type had been negotiated. This was due to the code incorrectly assuming that a stream of that type would always exist.

7.5 2018-02-21 CVE-2018-7284

A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.

7.5 2017-12-27 CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel driver was used, Asterisk would crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled, a user would have to first be authorized before reaching the crash point.

CWE : Common Weakness Enumeration

%idName
15% (6) CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
15% (6) CWE-20 Improper Input Validation
13% (5) CWE-476 NULL Pointer Dereference
13% (5) CWE-264 Permissions, Privileges, and Access Controls
5% (2) CWE-787 Out-of-bounds Write
5% (2) CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
2% (1) CWE-772 Missing Release of Resource after Effective Lifetime
2% (1) CWE-459 Incomplete Cleanup
2% (1) CWE-404 Improper Resource Shutdown or Release
2% (1) CWE-399 Resource Management Errors
2% (1) CWE-310 Cryptographic Issues
2% (1) CWE-284 Access Control (Authorization) Issues
2% (1) CWE-200 Information Exposure
2% (1) CWE-191 Integer Underflow (Wrap or Wraparound)
2% (1) CWE-190 Integer Overflow or Wraparound
2% (1) CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflo...
2% (1) CWE-89 Improper Sanitization of Special Elements used in an SQL Command ('...
2% (1) CWE-74 Failure to Sanitize Data into a Different Plane ('Injection')

OpenVAS Exploits

id Description
2012-10-03 Name : Gentoo Security Advisory GLSA 201209-15 (asterisk)
File : nvt/glsa_201209_15.nasl
2012-10-03 Name : Debian Security Advisory DSA 2550-2 (asterisk)
File : nvt/deb_2550_2.nasl
2012-09-23 Name : Debian Security Advisory DSA 2550-1 (asterisk)
File : nvt/deb_2550_1.nasl
2012-08-30 Name : FreeBSD Ports: asterisk
File : nvt/freebsd_asterisk2.nasl
2012-08-30 Name : Fedora Update for asterisk FEDORA-2012-4230
File : nvt/gb_fedora_2012_4230_asterisk_fc17.nasl
2012-08-30 Name : Fedora Update for asterisk FEDORA-2012-8670
File : nvt/gb_fedora_2012_8670_asterisk_fc17.nasl
2012-08-30 Name : Fedora Update for asterisk FEDORA-2012-6704
File : nvt/gb_fedora_2012_6704_asterisk_fc17.nasl
2012-08-10 Name : Debian Security Advisory DSA 2493-1 (asterisk)
File : nvt/deb_2493_1.nasl
2012-08-10 Name : Gentoo Security Advisory GLSA 201206-05 (Asterisk)
File : nvt/glsa_201206_05.nasl
2012-06-19 Name : Fedora Update for asterisk FEDORA-2012-8685
File : nvt/gb_fedora_2012_8685_asterisk_fc15.nasl
2012-06-19 Name : Fedora Update for asterisk FEDORA-2012-8692
File : nvt/gb_fedora_2012_8692_asterisk_fc16.nasl
2012-05-31 Name : FreeBSD Ports: asterisk16
File : nvt/freebsd_asterisk161.nasl
2012-05-04 Name : Fedora Update for asterisk FEDORA-2012-6612
File : nvt/gb_fedora_2012_6612_asterisk_fc16.nasl
2012-04-30 Name : Gentoo Security Advisory GLSA 201203-21 (Asterisk)
File : nvt/glsa_201203_21.nasl
2012-04-30 Name : Debian Security Advisory DSA 2460-1 (asterisk)
File : nvt/deb_2460_1.nasl
2012-04-02 Name : Fedora Update for asterisk FEDORA-2012-4318
File : nvt/gb_fedora_2012_4318_asterisk_fc16.nasl
2012-04-02 Name : Fedora Update for asterisk FEDORA-2012-4259
File : nvt/gb_fedora_2012_4259_asterisk_fc15.nasl

Information Assurance Vulnerability Management (IAVM)

id Description
2015-A-0078 Multiple Asterisk Products Security Bypass Vulnerability
Severity: Category I - VMSKEY: V0059871
2014-A-0085 Multiple Vulnerabilities in Asterisk Products
Severity: Category I - VMSKEY: V0052633
2014-A-0035 Multiple Vulnerabilities in Asterisk Products
Severity: Category I - VMSKEY: V0046183

Snort® IPS/IDS

Date Description
2020-05-07 Asterisk Manager Interface Originate action arbitrary command execution attempt
RuleID : 53579 - Type : PROTOCOL-VOIP - Revision : 1
2019-09-19 Digium Asterisk multiple malformed Accept headers denial of service attempt
RuleID : 51087 - Type : PROTOCOL-VOIP - Revision : 1
2019-09-19 Digium Asterisk multiple malformed Accept headers denial of service attempt
RuleID : 51086 - Type : PROTOCOL-VOIP - Revision : 1
2015-10-14 Digium Asterisk TLS Certificate Common Name null byte validation bypass attempt
RuleID : 36025 - Type : SERVER-OTHER - Revision : 3
2014-05-01 Digium Asterisk cookie stack buffer overflow attempt
RuleID : 30293 - Type : SERVER-WEBAPP - Revision : 4
2014-05-01 Digium Asterisk cookie stack buffer overflow attempt
RuleID : 30292 - Type : SERVER-WEBAPP - Revision : 4
2014-05-01 Digium Asterisk cookie stack buffer overflow attempt
RuleID : 30291 - Type : SERVER-WEBAPP - Revision : 4
2014-01-10 Digium Asterisk oversized Content-Length memory corruption attempt
RuleID : 25276 - Type : SERVER-OTHER - Revision : 5

Nessus® Vulnerability Scanner

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2018-11-26 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201811-11.nasl - Type: ACT_GATHER_INFO
2018-10-17 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4320.nasl - Type: ACT_GATHER_INFO
2018-09-28 Name: The remote Debian host is missing a security update.
File: debian_DLA-1523.nasl - Type: ACT_GATHER_INFO
2018-09-27 Name: A telephony application running on the remote host is affected by a remote de...
File: asterisk_ast_2018_009.nasl - Type: ACT_GATHER_INFO
2018-09-24 Name: The remote FreeBSD host is missing one or more security-related updates.
File: freebsd_pkg_77f67b46bd7511e881b6001999f8d30b.nasl - Type: ACT_GATHER_INFO
2018-06-15 Name: A telephony application running on the remote host is affected by a remote de...
File: asterisk_ast_2018_008.nasl - Type: ACT_GATHER_INFO
2018-06-15 Name: A telephony application running on the remote host is affected by multiple vu...
File: asterisk_ast_15_x_2018_007-008.nasl - Type: ACT_GATHER_INFO
2018-03-02 Name: A telephony application running on the remote host is affected by a Subscribe...
File: asterisk_ast_2018_002-005.nasl - Type: ACT_GATHER_INFO
2018-03-02 Name: A telephony application running on the remote host is affected by multiple vu...
File: asterisk_ast_2018_001-006.nasl - Type: ACT_GATHER_INFO
2018-02-23 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_933654ce17b811e890b8001999f8d30b.nasl - Type: ACT_GATHER_INFO
2018-01-15 Name: The remote Fedora host is missing a security update.
File: fedora_2017-66e9367f7e.nasl - Type: ACT_GATHER_INFO
2018-01-15 Name: The remote Fedora host is missing a security update.
File: fedora_2017-41242dfe10.nasl - Type: ACT_GATHER_INFO
2018-01-04 Name: A telephony application running on the remote host is affected by a remote de...
File: asterisk_ast_2017_014.nasl - Type: ACT_GATHER_INFO
2018-01-02 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4076.nasl - Type: ACT_GATHER_INFO
2018-01-02 Name: The remote Debian host is missing a security update.
File: debian_DLA-1225.nasl - Type: ACT_GATHER_INFO
2017-12-28 Name: The remote Fedora host is missing a security update.
File: fedora_2017-38fbcdffc3.nasl - Type: ACT_GATHER_INFO
2017-12-26 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_2a3bc6ace7c611e7a90b001999f8d30b.nasl - Type: ACT_GATHER_INFO
2017-12-06 Name: A telephony application running on the remote host is affected by a memory ex...
File: asterisk_ast_2017_013.nasl - Type: ACT_GATHER_INFO
2017-12-04 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_e91cf90cd6dd11e79d10001999f8d30b.nasl - Type: ACT_GATHER_INFO
2017-11-17 Name: A telephony application running on the remote host is affected by multiple vu...
File: asterisk_ast_2017_009-011.nasl - Type: ACT_GATHER_INFO
2017-11-10 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_be261737c53511e78da5001999f8d30b.nasl - Type: ACT_GATHER_INFO
2017-11-10 Name: The remote FreeBSD host is missing a security-related update.
File: freebsd_pkg_ab04cb0bc53311e78da5001999f8d30b.nasl - Type: ACT_GATHER_INFO
2017-01-13 Name: The remote Debian host is missing a security update.
File: debian_DLA-781.nasl - Type: ACT_GATHER_INFO
2016-10-26 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-3700.nasl - Type: ACT_GATHER_INFO
2016-05-04 Name: The remote Debian host is missing a security update.
File: debian_DLA-455.nasl - Type: ACT_GATHER_INFO