Critical Pointer Dereference Vulnerability in Asterisk Package
Summary
ALPINE-CVE-2019-13161: An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. Affects asterisk versions < 16.3.0-r2. Fixed in 16.3.0-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an open-source framework for building communications applications. It is widely used for VoIP (Voice over Internet Protocol) services, enabling users to create and manage phone systems. The package is known for its flexibility and extensive features, but it has been found to be vulnerable to a specific issue that can lead to service disruption.
Vulnerability Detail
An issue was discovered in Asterisk Open Source through versions 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0. A pointer dereference in the chan_sip module during SDP negotiation can allow an attacker to crash the Asterisk service. This vulnerability arises when an attacker sends a T.38 re-invite request, followed by an SDP answer that improperly combines a T.38 UDPTL stream with another media stream containing a codec. This misconfiguration can lead to denial of service, impacting the availability of the Asterisk service.
How To Fix
Minimum fixed version
16.3.0-r2
This is the first release that contains the fix.
sudo apk add --upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that the chan_sip module is not configured to handle T.38 re-invite requests, or restrict access to the service to trusted users only.
Conclusion
The pointer dereference vulnerability in the Asterisk package poses a risk of service disruption through improper SDP negotiation. It is crucial to update to the patched versions to ensure the security and availability of your communications applications.
See every vulnerability recorded for asterisk →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
The affected versions include Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update the package immediately, consider implementing the suggested workaround to mitigate the risk.
More information about Asterisk can be found on its official website and documentation, which provide insights into its features and usage.
References
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
