DEBIAN-CVE-2018-12227

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However,...

UBUNTU-CVE-2018-12227

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However,...

CVE-2018-12227

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However,...

CVE-2018-12228

An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk via TCP/TLS, if the client abruptly disconnects, or sends a specially crafted message, then Asterisk gets caught in an infinite loop while trying to read the data stream. This renders the system unusabl...

CVE-2018-12227

An issue was discovered in Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 and Certified Asterisk 13.18-cert before 13.18-cert4 and 13.21-cert before 13.21-cert2. When endpoint specific ACL rules block a SIP request, they respond with a 403 forbidden. However,...

CVE-2018-12228

An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk via TCP/TLS, if the client abruptly disconnects, or sends a specially crafted message, then Asterisk gets caught in an infinite loop while trying to read the data stream. This renders the system unusabl...

CVE-2018-12228

CVE-2018-12228 affects Asterisk Open Source 15.x before 15.4.1. When connected via TCP/TLS, if the client disconnects abruptly or sends a specially crafted message, Asterisk can enter an infinite loop while reading the data stream, resulting in a denial of service and rendering the system unusabl...

CVE-2018-12227

CVE-2018-12227 affects Asterisk Open Source 13.x before 13.21.1, 14.x before 14.7.7, and 15.x before 15.4.1 (including Certified Asterisk 13.18-cert4/13.21-cert2). The issue is an information-disclosure in SIP ACL handling: when endpoint-specific ACLs block a request, a 403 is returned; if the en...

PT-2018-11059 · Sangoma · Asterisk Open Source

Name of the Vulnerable Software and Affected Versions: Asterisk Open Source versions 15.x before 15.4.1 Description: An issue was discovered in Asterisk Open Source. When connected to Asterisk via TCP/TLS, if the client abruptly disconnects, or sends a specially crafted message, then Asterisk get...

FreeBSD : asterisk -- PJSIP endpoint presence disclosure when using ACL (0137167b-6dca-11e8-a671-001999f8d30b)

The Asterisk project reports : When endpoint specific ACL rules block a SIP request they respond with a 403 forbidden. However, if an endpoint is not identified then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot ...

FreeBSD : asterisk -- Infinite loop when reading iostreams (f14ce57f-6dc8-11e8-a671-001999f8d30b)

The Asterisk project reports : When connected to Asterisk via TCP/TLS if the client abruptly disconnects, or sends a specially crafted message then Asterisk gets caught in an infinite loop while trying to read the data stream. Thus rendering the system as unusable. C Tenable Network Security, Inc...

Digium Asterisk Remote Denial of Service Vulnerability

Asterisk is a free software, open source software that implements the functionality of a telephone user switch PBX. Asterisk suffers from a denial of service vulnerability. An attacker could exploit the vulnerability to corrupt the application and cause a denial of service...

Digium Asterisk Open Source and Certified Asterisk Denial of Service Vulnerabilities (CNVD-2018-19592)

Asterisk Open Source and Certified Asterisk are both open source telephone switch PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, and interactive voice response IVR. Asterisk Open Source and Certified Asterisk have a...

asterisk -- PJSIP endpoint presence disclosure when using ACL

The Asterisk project reports: When endpoint specific ACL rules block a SIP request they respond with a 403 forbidden. However, if an endpoint is not identified then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot b...

asterisk -- Infinite loop when reading iostreams

The Asterisk project reports: When connected to Asterisk via TCP/TLS if the client abruptly disconnects, or sends a specially crafted message then Asterisk gets caught in an infinite loop while trying to read the data stream. Thus rendering the system as unusable...

Fedora Update for asterisk FEDORA-2018-cf1dd2166b

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 27 Update: asterisk-14.7.6-2.fc27

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

Digium Asterisk Out-of-Bounds Write (CVE-2018-7284)

An out-of-bounds write vulnerability exists in Asterisk. The vulnerability is due to improper processing of SIP SUBSCRIBE requests. Successful exploitation would result in a denial of service condition...

[SECURITY] Fedora 28 Update: asterisk-15.3.0-1.fc28

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

Asterisk 13.x < 13.19.2 / 14.x < 14.7.6 / 13.13 < 13.18-cert3 Multiple DoS Vulnerabilities (AST-2018-002, AST-2018-003, AST-2018-004, & AST-2018-005)

According to its SIP banner, the version of Asterisk running on the remote host is 13.x prior to 13.19.2, 14.x prior to 14.7.6, or 13.18 prior to 13.18-cert3. It is therefore, affected by a Multiple Denial of Service Vulnerabilities as described in AST-2018-002, AST-2018-003, AST-2018-004, &...