Critical Command Injection Vulnerability in Asterisk Package
Summary
ALPINE-CVE-2019-18610: An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. Affects asterisk versions < 16.3.0-r3. Fixed in 16.3.0-r3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an open-source framework for building communications applications. It is widely used for VoIP (Voice over Internet Protocol) services and provides functionalities such as call handling, conference calling, and voicemail. The package is essential for developers looking to implement telephony solutions. However, it has been found to be vulnerable to a command injection issue that can be exploited by unauthorized users.
Vulnerability Detail
An issue was discovered in manager.c in Sangoma Asterisk through versions 13.x, 16.x, 17.x, and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could exploit a specially crafted Originate AMI request to execute arbitrary system commands. This vulnerability poses a significant risk as it allows attackers to gain unauthorized access and control over the system, potentially leading to data breaches or service disruptions.
How To Fix
Minimum fixed version
16.3.0-r3
This is the first release that contains the fix.
sudo apk add --upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Asterisk Manager Interface (AMI) to trusted IP addresses only. This can be done by modifying the configuration file to limit connections to specific IPs, thereby reducing the risk of exploitation until the package is updated.
Conclusion
The Asterisk package has a critical command injection vulnerability that can be exploited by unauthorized users. It is essential to update to the patched versions to secure your system. Implementing temporary workarounds can help mitigate risks until the update is applied. Regular monitoring of vulnerabilities using tools like Vulert is recommended for ongoing security.
See every vulnerability recorded for asterisk →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Asterisk versions 13.x, 16.x, 17.x, and Certified Asterisk 13.21 through 13.21-cert4 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to unauthorized command execution, data breaches, and service disruptions.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
