Buffer Overflow in Sangoma Asterisk Allows Remote Code Execution
Summary
CVE-2020-35776: A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses. Affects asterisk across 5 version ranges.
>= 2c1bba3cbec008c8ce35c78a2c79f9f207ea58bc, <= fd5b3a1b6f686db27f98281ec21a9c8fb04a787c
>= 5ffe12b6ef30cd503f85d75745fd8d9c2cfafe47, <= 1edb44b2a9e6d68cfccf4339044751c8830e1d14
< 16.16.1-r0
>= 85335355efb2d7914a1fe20ed31afcef15fd210c, <= 3f100c22d4664012247efed391c595833a15d7ee
>= a65908f83e2f17a3aca7eb39c8e06045aca02674, <= 105df4b089e19c7e296d425965623f3428720cd1
Fixed in 16.16.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Sangoma Asterisk is an open-source communication platform that provides voice, video, and messaging services. It is widely used in various industries for building telephony applications and systems. However, a vulnerability has been discovered in versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 of Sangoma Asterisk, which could allow remote attackers to execute arbitrary code on the affected system.
Vulnerability Detail
The vulnerability, identified as CVE-2020-35776, is a buffer overflow issue present in the res_pjsip_diversion.c module of Sangoma Asterisk. By deliberately misusing SIP 181 responses, a remote attacker can trigger a buffer overflow, leading to a crash of the Asterisk server. This vulnerability can be exploited remotely without authentication, potentially resulting in a denial-of-service (DoS) condition.
How To Fix
Minimum fixed version
16.16.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability at the moment. It is recommended to apply the official fix provided by Sangoma by updating to the patched versions of Asterisk.
Conclusion
In conclusion, a buffer overflow vulnerability has been identified in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1. This vulnerability can be exploited remotely, potentially leading to a denial-of-service condition. Users are advised to update their installations to the patched versions provided by Sangoma to mitigate the risk. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for asterisk →
FAQ
Sangoma Asterisk is an open-source communication platform used for building telephony applications and systems.
Versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 of Sangoma Asterisk are affected by this vulnerability.
Remote attackers can exploit this vulnerability by deliberately misusing SIP 181 responses, triggering a buffer overflow and potentially crashing the Asterisk server.
This vulnerability can lead to a denial-of-service (DoS) condition, potentially disrupting communication services relying on the affected Sangoma Asterisk installations.
No, there is currently no known workaround for this vulnerability. It is recommended to apply the official fix by updating to the patched versions of Asterisk.
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
