Critical Vulnerability in Asterisk: T.38 Re-negotiation Crash Risk
Summary
ALPINE-CVE-2021-26717: An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. Affects asterisk versions < 16.16.1-r0. Fixed in 16.16.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an open-source framework for building communications applications. It enables users to create voice over IP (VoIP) systems, conference servers, and other telephony applications. The framework is widely used in various industries for its flexibility and extensive feature set. However, it has been found to have a critical vulnerability that affects its stability during T.38 re-negotiation processes.
Vulnerability Detail
An issue was discovered in Sangoma Asterisk versions 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1. When re-negotiating for T.38, if the initial remote response was delayed, Asterisk could send both audio and T.38 in the Session Description Protocol (SDP). If the remote endpoint then declined the T.38 stream, Asterisk would crash, leading to potential service disruptions and denial of service.
How To Fix
Minimum fixed version
16.16.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure your Asterisk system to avoid T.38 re-negotiation or monitor the SDP responses closely to prevent sending both audio and T.38 streams simultaneously.
Conclusion
The vulnerability in Asterisk related to T.38 re-negotiation poses a significant risk to system stability. It is crucial for users to update their installations to the latest patched versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for asterisk →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Asterisk versions 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to Asterisk crashing, resulting in service disruptions and denial of service for users relying on the application.
Yes, updating to the patched versions of Asterisk will permanently fix the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
