Integer Signedness Vulnerability in Asterisk Package: CVE-2019-7251
Summary
ALPINE-CVE-2019-7251: An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially cr... Affects asterisk versions < 16.3.0-r0. Fixed in 16.3.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an open-source framework for building communications applications. It is widely used for VoIP (Voice over Internet Protocol) services, enabling functionalities such as voice calls, video calls, and messaging. The framework is modular, allowing developers to extend its capabilities with various plugins and modules. However, certain versions of Asterisk have been found to be vulnerable to an Integer Signedness issue, which can lead to application crashes under specific conditions.
Vulnerability Detail
The vulnerability identified as CVE-2019-7251 arises from an Integer Signedness issue in the res_pjsip_sdp_rtp module of Asterisk. This flaw allows remote authenticated users to exploit a specially crafted SDP (Session Description Protocol) protocol violation, potentially leading to a crash of the Asterisk application. The affected versions include Asterisk 15.7.1 and earlier, as well as 16.1.1 and earlier. The ramifications of this vulnerability can disrupt communication services, leading to downtime and loss of functionality for users relying on Asterisk for their telephony needs.
How To Fix
Minimum fixed version
16.3.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if immediate patching is not feasible, consider restricting access to the Asterisk service to trusted users only. This can be done by configuring firewall rules to limit incoming connections to known IP addresses.
Conclusion
CVE-2019-7251 is a significant vulnerability affecting various versions of the Asterisk package, which can lead to application crashes. It is crucial to update to the patched versions to mitigate the risk. Users should also consider implementing workarounds to limit exposure until updates can be applied.
See every vulnerability recorded for asterisk →
FAQ
CVE-2019-7251 is a vulnerability in the Asterisk package that allows remote authenticated users to crash the application through a specially crafted SDP protocol violation.
The affected versions include Asterisk 15.7.1 and earlier, and 16.1.1 and earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2019-7251 is 6.5, indicating a medium severity level.
If you cannot update the package immediately, consider implementing firewall rules to restrict access to the Asterisk service to trusted users only.
References
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
