The vulnerability of the implementations of DTLS (Datagram Transport Layer Security) and SRTP protocols in Asterisk IP-telephony management systems and Certified Asterisk allows a attacker to induce a service failure.

Bug in Datagram Transport Layer Security and Secure Real-time Protocol in Asterisk systems can trigger service failure via ClientHello processing.

Reporter	Title	Published	Views	Family All 52
AlpineLinux	CVE-2023-49786	14 Dec 202319:47	–	alpinelinux
Circl	CVE-2023-49786	20 Dec 202311:00	–	circl
CNNVD	Asterisk Security Vulnerabilities	14 Dec 202300:00	–	cnnvd
CVE	CVE-2023-49786	14 Dec 202319:47	–	cve
Cvelist	CVE-2023-49786 Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation	14 Dec 202319:47	–	cvelist
Debian	[SECURITY] [DLA 3696-1] asterisk security update	28 Dec 202323:01	–	debian
Debian	[SECURITY] [DSA 5596-1] asterisk security update	4 Jan 202421:21	–	debian
Debian CVE	CVE-2023-49786	14 Dec 202319:47	–	debiancve
Tenable Nessus	Debian dla-3696 : asterisk - security update	22 Jan 202500:00	–	nessus
Tenable Nessus	Fedora 44 : asterisk (2026-38d71393c1)	30 Apr 202600:00	–	nessus

Vulners

Node

digium,asteriskRange19.8.1–20.5.0

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/176251/Asterisk-20.1.0-Denial-Of-Service.html
openwall	www.openwall.com/lists/oss-security/2023/12/15/7
github	www.github.com/EnableSecurity/advisories/tree/master/ES2023-01-asterisk-dtls-hello-race
github	www.github.com/asterisk/asterisk/commit/d7d7764cb07c8a1872804321302ef93bf62cba05
github	www.github.com/asterisk/asterisk/security/advisories/GHSA-hxj9-xwr8-w8pq
vuldb	www.vuldb.com/ru/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.10/
repo	www.repo.red-soft.ru/redos/7.3c/x86_64/updates/
web	www.web.nvd.nist.gov/view/vuln/detail

12 Aug 2024 00:00Current

6.6Medium risk

Vulners AI Score6.6

CVSS 37.5

CVSS 27.8

EPSS0.05338