Denial of Service Vulnerability in Asterisk Package: CVE-2011-4598
Summary
DEBIAN-CVE-2011-4598: The handle_request_info function in channels/chan_sip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service (NULL pointe... Affects asterisk versions < 1:1.8.8.0~dfsg-1. Fixed in 1:1.8.8.0~dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an open-source framework for building communications applications, including VoIP gateways and conference servers. It is widely used for its flexibility and extensive feature set. However, certain versions of Asterisk are vulnerable to a denial of service attack due to a flaw in the handle_request_info function within the SIP channel handling code.
Vulnerability Detail
The vulnerability arises from the handle_request_info function in channels/chan_sip.c, affecting Asterisk versions 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2. When the automon feature is enabled, a remote attacker can exploit this vulnerability by sending a crafted sequence of SIP requests, leading to a NULL pointer dereference and causing the Asterisk daemon to crash. This can result in service downtime and disruption of communication services.
How To Fix
Minimum fixed version
1:1.8.8.0~dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the automon feature in your Asterisk configuration to mitigate the risk of this vulnerability until you can apply the patch.
Conclusion
The CVE-2011-4598 vulnerability in the Asterisk package poses a significant risk of denial of service due to a flaw in the SIP handling code. It is crucial for users to update their Asterisk installations to the patched version to mitigate this risk and ensure uninterrupted communication services.
See every vulnerability recorded for asterisk →
FAQ
CVE-2011-4598 is a vulnerability in the Asterisk package that allows remote attackers to cause a denial of service by exploiting a flaw in the SIP channel handling code.
Asterisk versions 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to a denial of service, causing the Asterisk daemon to crash and disrupting communication services.
Yes, a patch is available in the form of an updated Asterisk package. You should upgrade to version 1:1.8.8.0~dfsg-1 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
