Asterisk - Regression Update
Summary
DLA-781-2: asterisk - regression update. Affects asterisk versions < 1:1.8.13.1~dfsg1-3+deb7u6. Fixed in 1:1.8.13.1~dfsg1-3+deb7u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Asterisk is an Open Source PBX and telephony toolkit. It provides functionality for making and receiving phone calls, voicemail, call routing, and more. Asterisk is widely used in various communication systems and can be configured to work with different protocols, including SIP (Session Initiation Protocol).
Vulnerability Detail
Two security vulnerabilities have been discovered in Asterisk:
-
CVE-2014-2287: When Asterisk is configured with chan_sip, remote authenticated users can cause a denial of service by sending an INVITE request with a malformed or invalid value in the Session-Expires or Min-SE header. This can lead to channel and file descriptor consumption, impacting the availability of the system.
-
CVE-2016-7551: The overlap dialing feature in chan_sip allows a device to report that the dialed number is incomplete and more digits are required. If this feature is used with a device that has performed username/password authentication, RTP (Real-time Transport Protocol) resources are leaked. This can result in RTP port exhaustion, preventing the establishment of new RTP sessions.
How To Fix
Minimum fixed version
1:1.8.13.1~dfsg1-3+deb7u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading the Asterisk package to the recommended version will address the identified vulnerabilities. It is important to keep software up to date to ensure the security and stability of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for asterisk →
FAQ
Asterisk is an Open Source PBX and telephony toolkit used for making and receiving phone calls, voicemail, call routing, and more.
chan_sip is a channel driver in Asterisk that provides support for the SIP protocol, allowing Asterisk to communicate with SIP devices.
RTP (Real-time Transport Protocol) is a protocol used for transmitting audio and video over IP networks. In the context of Asterisk, RTP is used for establishing and managing audio sessions between devices.
The first vulnerability (CVE-2014-2287) can be exploited by remote authenticated users who send INVITE requests with malformed or invalid values in certain headers. The second vulnerability (CVE-2016-7551) can be exploited when the overlap dialing feature in chan_sip is used with a device that has performed username/password authentication.
The first vulnerability can lead to a denial of service, consuming system resources and impacting the availability of the Asterisk system. The second vulnerability can result in RTP port exhaustion, preventing the establishment of new RTP sessions.
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
