Buffer Overflow Vulnerability in Asterisk Package: CVE-2021-26713
Summary
ALPINE-CVE-2021-26713: A stack-based buffer overflow in res_rtp_asterisk.c in Sangoma Asterisk before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6 allows an authenticated WebRTC client to cause a... Affects asterisk versions < 16.16.1-r0. Fixed in 16.16.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an open-source framework for building communications applications. It is widely used for VoIP (Voice over Internet Protocol) services and supports various telephony protocols. The package allows users to create custom telephony applications and is known for its flexibility and scalability. However, it is susceptible to vulnerabilities, such as CVE-2021-26713, which can compromise its stability and security.
Vulnerability Detail
CVE-2021-26713 is a stack-based buffer overflow vulnerability found in the res_rtp_asterisk.c file of the Asterisk package. This vulnerability arises from a signedness comparison mismatch, allowing an authenticated WebRTC client to send multiple hold/unhold requests in rapid succession. The result can lead to an Asterisk crash, disrupting service and potentially exposing the system to further attacks. The vulnerability affects multiple versions of Asterisk, including those prior to 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1.
How To Fix
Minimum fixed version
16.16.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, limit the number of hold/unhold requests that can be sent by WebRTC clients to prevent triggering the buffer overflow. This can be implemented by modifying the application logic to introduce a delay or a threshold for such requests.
Conclusion
CVE-2021-26713 is a significant vulnerability in the Asterisk package that can lead to service disruptions. It is crucial for users to update to the patched versions to ensure the security and stability of their communications applications. Implementing workarounds can provide temporary relief until an update can be applied.
See every vulnerability recorded for asterisk →
FAQ
CVE-2021-26713 is a buffer overflow vulnerability in the Asterisk package that can cause crashes when multiple hold/unhold requests are sent rapidly by an authenticated WebRTC client.
Versions of Asterisk prior to 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. Visit Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score for CVE-2021-26713 is 6.5, indicating a medium severity level.
If an immediate update is not possible, implement a workaround by limiting the frequency of hold/unhold requests from WebRTC clients to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
