Asterisk - Security Update
Summary
DLA-455-1: asterisk - security update. Affects asterisk versions < 1:1.8.13.1~dfsg1-3+deb7u4. Fixed in 1:1.8.13.1~dfsg1-3+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an open-source framework for building communications applications. It provides functionality for making and receiving calls, voicemail, conference calling, and more. This vulnerability affects Asterisk versions 11.x before 11.12.1 and 12.x before 12.5.1, as well as Certified Asterisk 11.6 before 11.6-cert6. The vulnerability lies in the res_fax_spandsp module, which allows remote authenticated users to cause a denial of service (crash) by sending an out of call message that is not properly handled in the ReceiveFax dialplan application.
Vulnerability Detail
The vulnerability, identified as CVE-2014-6610, allows remote authenticated users to crash the Asterisk server by exploiting the res_fax_spandsp module. By sending an out of call message, the server fails to handle it correctly in the ReceiveFax dialplan application, resulting in a denial of service. This vulnerability can be exploited by authenticated users, potentially disrupting communication services.
How To Fix
Minimum fixed version
1:1.8.13.1~dfsg1-3+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided security update to mitigate the risk.
Conclusion
Asterisk versions 11.x before 11.12.1 and 12.x before 12.5.1, as well as Certified Asterisk 11.6 before 11.6-cert6, are vulnerable to a denial of service (crash) attack through the res_fax_spandsp module. It is crucial to update to the recommended versions to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for asterisk →
FAQ
Asterisk versions 11.x before 11.12.1 and 12.x before 12.5.1, as well as Certified Asterisk 11.6 before 11.6-cert6, are affected.
Remote authenticated users can exploit this vulnerability by sending an out of call message that is not properly handled in the ReceiveFax dialplan application.
The vulnerability can cause a denial of service (crash) on the Asterisk server, potentially disrupting communication services.
No, there is no known workaround for this vulnerability. It is recommended to apply the provided security update.
The security update can be obtained from the official Asterisk website or through package managers.
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
