Asterisk - Denial of Service and RTP Resource Leakage Vulnerabilities
Summary
DLA-781-1: asterisk - security update. Affects asterisk versions < 1:1.8.13.1~dfsg1-3+deb7u5. Fixed in 1:1.8.13.1~dfsg1-3+deb7u5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an Open Source PBX and telephony toolkit. It provides functionality for making and receiving phone calls, voicemail, call routing, and more. The package is widely used in various telecommunication systems and networks.
Vulnerability Detail
Two security vulnerabilities have been discovered in Asterisk:
-
Denial of Service (DoS) Vulnerability (CVE-2014-2287): This vulnerability occurs when the chan_sip module is configured in a certain way. Remote authenticated users can exploit this vulnerability by sending INVITE requests with malformed or invalid values in the Session-Expires or Min-SE headers. This can lead to a DoS attack, causing channel and file descriptor consumption.
-
RTP Resource Leakage Vulnerability (CVE-2016-7551): This vulnerability affects the overlap dialing feature in the chan_sip module. When used with a device that has performed username/password authentication, RTP resources are leaked. The code fails to release old RTP resources before allocating new ones, leading to RTP port exhaustion and the inability to set up new RTP sessions.
How To Fix
Minimum fixed version
1:1.8.13.1~dfsg1-3+deb7u5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities.
Conclusion
Two security vulnerabilities have been discovered in Asterisk, including a Denial of Service vulnerability and an RTP Resource Leakage vulnerability. It is recommended to upgrade your Asterisk packages to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for asterisk →
FAQ
Asterisk is an Open Source PBX and telephony toolkit used for making and receiving phone calls, voicemail, call routing, and more.
The Denial of Service vulnerability in Asterisk can be exploited by remote authenticated users to consume channels and file descriptors, leading to a potential disruption of service.
The RTP Resource Leakage vulnerability in Asterisk can be exploited when the overlap dialing feature is used with a device that has performed username/password authentication. This can lead to the leakage of RTP resources, exhaustion of RTP ports, and the inability to set up new RTP sessions.
Yes, upgrading your Asterisk packages to version 1:1.8.13.1~dfsg1-3+deb7u5 or later will fix these vulnerabilities.
You can upgrade your Asterisk packages by using the package manager of your Debian 7 Wheezy system and installing the latest available version.
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
