Asterisk Open Source res_pjsip_session Crash (CVE-2020-28327)
Summary
CVE-2020-28327: A res_pjsip_session crash was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1. Affects asterisk across 2 version ranges.
< 16.14.1-r0
>= 85335355efb2d7914a1fe20ed31afcef15fd210c, < 57693c3d5059c69222378b798cacc4685b0985e6
Fixed in 16.14.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Asterisk Open Source is a widely used open-source communication platform that provides features such as voice, video, and messaging services. It is designed to work with various communication protocols, including SIP (Session Initiation Protocol). The res_pjsip_session module in Asterisk is responsible for managing SIP sessions. However, a vulnerability has been discovered in versions 13.x, 16.x, 17.x, and 18.x of Asterisk Open Source, as well as Certified Asterisk before 16.8-cert5. This vulnerability, identified as CVE-2020-28327, affects the res_pjsip_session module and can lead to a crash in certain circumstances.
Vulnerability Detail
The vulnerability arises when Asterisk receives a new SIP Invite but fails to properly handle the creation of the dialog object associated with it. This creates a gap between the creation of the dialog object and its subsequent use by the thread that created it. In specific scenarios, another thread can free the dialog object during this gap, leading to a crash when the initial-creation thread tries to access the dialog object or its dependent objects. It is important to note that this crash can only occur when using a connection-oriented protocol (e.g., TCP or TLS) for SIP transport and when the remote client is authenticated or Asterisk is configured for anonymous calling.
How To Fix
Minimum fixed version
16.14.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the available updates as soon as possible.
Conclusion
In conclusion, the res_pjsip_session crash vulnerability in Asterisk Open Source can lead to crashes in certain scenarios when handling SIP sessions. It is crucial to update to the fixed versions of Asterisk Open Source or Certified Asterisk to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for asterisk →
FAQ
Asterisk Open Source is an open-source communication platform that provides voice, video, and messaging services.
res_pjsip_session is a module in Asterisk that handles the management of SIP sessions.
Versions 13.x, 16.x, 17.x, and 18.x of Asterisk Open Source, as well as Certified Asterisk before 16.8-cert5, are affected.
The crash can occur when using a connection-oriented protocol (e.g., TCP or TLS) for SIP transport and when the remote client is authenticated or Asterisk is configured for anonymous calling.
No, there is no known workaround. It is recommended to update to the fixed versions of Asterisk Open Source or Certified Asterisk.
References
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
