Denial of Service Vulnerability in Asterisk Package - CVE-2011-4598
Summary
CVE-2011-4598: The handle_request_info function in channels/chan_sip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service (NULL pointe... Affects asterisk versions < 1:1.8.8.0~dfsg-1. Fixed in 1:1.8.8.0~dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an open-source framework for building communications applications, including VoIP services. It provides functionalities such as call routing, conferencing, and voicemail. The package is widely used in telephony systems and is known for its flexibility and extensibility. However, certain versions of Asterisk are vulnerable to a denial of service attack due to a flaw in the handle_request_info function, which can be exploited by remote attackers.
Vulnerability Detail
The vulnerability, identified as CVE-2011-4598, exists in the handle_request_info function within the channels/chan_sip.c file of Asterisk versions 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2. When the automon feature is enabled, a crafted sequence of SIP requests can lead to a NULL pointer dereference, causing the Asterisk daemon to crash. This results in a denial of service, impacting the availability of telephony services.
How To Fix
Minimum fixed version
1:1.8.8.0~dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider disabling the automon feature in your Asterisk configuration to mitigate the risk of exploitation until a proper update can be applied.
Conclusion
CVE-2011-4598 is a critical vulnerability in certain versions of the Asterisk package that can lead to denial of service. It is essential for users to upgrade to a patched version to ensure the security and availability of their telephony services. Additionally, temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for asterisk →
FAQ
CVE-2011-4598 is a vulnerability in the Asterisk package that allows remote attackers to crash the Asterisk daemon through a crafted sequence of SIP requests.
Asterisk versions 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2 are affected by this vulnerability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Exploitation of this vulnerability can lead to a denial of service, causing the Asterisk daemon to crash and disrupting telephony services.
Yes, you can disable the automon feature in your Asterisk configuration as a temporary workaround until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.