Vulnerability in Digium Asterisk Allows Remote Server to Crash
Summary
CVE-2021-26906: An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. Affects asterisk across 2 version ranges.
< 16.16.1-r0
>= 85335355efb2d7914a1fe20ed31afcef15fd210c, < fbaea22493a6061d4bdc87bddc0cb5971e5f71d9
Fixed in 16.16.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Digium Asterisk is an open-source communication platform that provides voice, video, and messaging services. It is widely used in various industries for telephony applications. However, a vulnerability has been discovered in Digium Asterisk versions 13.38.1, 14.x, 15.x, 16.x, 17.x, and 18.x, as well as Certified Asterisk version 16.8-cert5. This vulnerability affects the SDP negotiation process in PJSIP, which can be exploited by a remote server to cause a crash in the Asterisk server.
Vulnerability Detail
The vulnerability, identified as CVE-2021-26906, arises due to a flaw in the SDP negotiation mechanism of PJSIP. By sending specific SIP responses, an attacker can trigger an SDP negotiation failure, leading to a crash in the Asterisk server. This vulnerability can be exploited remotely, potentially causing a denial-of-service (DoS) condition. The severity of this vulnerability is rated as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H with a score of 5.9.
How To Fix
Minimum fixed version
16.16.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability.
Conclusion
In conclusion, the vulnerability in Digium Asterisk versions 13.38.1, 14.x, 15.x, 16.x, 17.x, and 18.x, as well as Certified Asterisk version 16.8-cert5, allows a remote server to crash the Asterisk server by exploiting a flaw in the SDP negotiation process. It is recommended to update to the fixed versions mentioned above to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for asterisk →
FAQ
Digium Asterisk is an open-source communication platform used for voice, video, and messaging services.
The vulnerability allows a remote server to crash the Asterisk server, potentially causing a denial-of-service (DoS) condition.
By sending specific SIP responses, an attacker can trigger an SDP negotiation failure, leading to a crash in the Asterisk server.
The severity of this vulnerability is rated as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H with a score of 5.9.
To fix this vulnerability, update the affected Digium Asterisk versions to the provided fixed versions.
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
