FreeBSD : asterisk -- PJSIP endpoint presence disclosure when using ACL (0137167b-6dca-11e8-a671-001999f8d30b)

The Asterisk project reports : When endpoint specific ACL rules block a SIP request they respond with a 403 forbidden. However, if an endpoint is not identified then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot ...

Digium Asterisk Remote Denial of Service Vulnerability

Asterisk is a free software, open source software that implements the functionality of a telephone user switch PBX. Asterisk suffers from a denial of service vulnerability. An attacker could exploit the vulnerability to corrupt the application and cause a denial of service...

Digium Asterisk Open Source and Certified Asterisk Denial of Service Vulnerabilities (CNVD-2018-19592)

Asterisk Open Source and Certified Asterisk are both open source telephone switch PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, and interactive voice response IVR. Asterisk Open Source and Certified Asterisk have a...

asterisk -- Infinite loop when reading iostreams

The Asterisk project reports: When connected to Asterisk via TCP/TLS if the client abruptly disconnects, or sends a specially crafted message then Asterisk gets caught in an infinite loop while trying to read the data stream. Thus rendering the system as unusable...

asterisk -- PJSIP endpoint presence disclosure when using ACL

The Asterisk project reports: When endpoint specific ACL rules block a SIP request they respond with a 403 forbidden. However, if an endpoint is not identified then a 401 unauthorized response is sent. This vulnerability just discloses which requests hit a defined endpoint. The ACL rules cannot b...

Fedora Update for asterisk FEDORA-2018-cf1dd2166b

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 27 Update: asterisk-14.7.6-2.fc27

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

Digium Asterisk Out-of-Bounds Write (CVE-2018-7284)

An out-of-bounds write vulnerability exists in Asterisk. The vulnerability is due to improper processing of SIP SUBSCRIBE requests. Successful exploitation would result in a denial of service condition...

[SECURITY] Fedora 28 Update: asterisk-15.3.0-1.fc28

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

Asterisk 15.x < 15.2.2 Multiple Vulnerabilities (AST-2018-001 - AST-2018-006)

According to its SIP banner, the version of Asterisk running on the remote host is 15.x prior to 15.2.2. It is therefore, affected by multiple vulnerabilities as described in AST-2018-001, AST-2018-002, AST-2018-003, AST-2018-004, AST-2018-005, & AST-2018-006 advisories. Note that Nessus has not...

Asterisk 13.x < 13.19.2 / 14.x < 14.7.6 / 13.13 < 13.18-cert3 Multiple DoS Vulnerabilities (AST-2018-002, AST-2018-003, AST-2018-004, & AST-2018-005)

According to its SIP banner, the version of Asterisk running on the remote host is 13.x prior to 13.19.2, 14.x prior to 14.7.6, or 13.18 prior to 13.18-cert3. It is therefore, affected by a Multiple Denial of Service Vulnerabilities as described in AST-2018-002, AST-2018-003, AST-2018-004, &...

Asterisk chan_pjsip 15.2.0 - SDP fmtp Denial of Service

Asterisk chanpjsip 15.2.0 - SDP fmtp Denial of Service ''' Segmentation fault occurs in asterisk with an invalid SDP fmtp attribute - Authors: - Alfred Farrugia - Sandro Gauci - Latest vulnerable version: Asterisk 15.2.0 running chanpjsip - References: AST-2018-003 - Enable Security Advisory: -...

Asterisk 15.2.0 chan_pjsip SDP fmtp Denial Of Service Exploit

Asterisk version 15.2.0 running chanpjsip suffers from an SDP message related denial of service vulnerability. Segmentation fault occurs in asterisk with an invalid SDP fmtp attribute - Authors: - Alfred Farrugia - Sandro Gauci - Latest vulnerable version: Asterisk 15.2.0 running chanpjsip -...

Asterisk 15.2.0 chan_pjsip INVITE Denial Of Service Exploit

Asterisk running chanpjsip suffers from an INVITE message denial of service vulnerability. Versions affected include Versions affected include 15.2.0, 15.1.0, 15.0.0, 13.19.0, 13.11.2, and 14.7.5. Crash occurs when sending a repeated number of INVITE messages over TCP or TLS transport - Authors: ...

Asterisk 15.2.0 chan_pjsip SDP Media Format Denial Of Service Exploit

Asterisk running chanpjsip suffers from an SDP message related denial of service vulnerability. Versions affected include 13.10.0, 15.1.3, 15.1.4, 15.1.5, and 15.2.0. Segmentation fault occurs in Asterisk with an invalid SDP media format description - Authors: - Alfred Farrugia - Sandro Gauci -...

Asterisk chan_pjsip 15.2.0 - SDP Denial of Service

Asterisk chanpjsip 15.2.0 - SDP Denial of Service ''' Segmentation fault occurs in Asterisk with an invalid SDP media format description - Authors: - Alfred Farrugia - Sandro Gauci - Latest vulnerable version: Asterisk 15.2.0 running chanpjsip - References: AST-2018-002 - Enable Security Advisory...

Asterisk chan_pjsip 15.2.0 - 'SDP' Denial of Service

''' Segmentation fault occurs in Asterisk with an invalid SDP media format description - Authors: - Alfred Farrugia - Sandro Gauci - Latest vulnerable version: Asterisk 15.2.0 running chanpjsip - References: AST-2018-002 - Enable Security Advisory: - Vendor Advisory: - Tested vulnerable versions:...

Asterisk chan_pjsip 15.2.0 - 'SUBSCRIBE' Stack Corruption

''' SUBSCRIBE message with a large Accept value causes stack corruption - Authors: - Alfred Farrugia - Sandro Gauci - Latest vulnerable version: Asterisk 15.2.0 running chanpjsip - Tested vulnerable versions: 15.2.0, 13.19.0, 14.7.5, 13.11.2 - References: AST-2018-004, CVE-2018-7284 - Advisory UR...

Asterisk chan_pjsip 15.2.0 - 'INVITE' Denial of Service

''' Crash occurs when sending a repeated number of INVITE messages over TCP or TLS transport - Authors: - Alfred Farrugia - Sandro Gauci - Latest vulnerable version: Asterisk 15.2.0 running chanpjsip installed with --with-pjproject-bundled - References: AST-2018-005, CVE-2018-7286 - Enable Securi...

Asterisk chan_pjsip 15.2.0 - 'SDP fmtp' Denial of Service

''' Segmentation fault occurs in asterisk with an invalid SDP fmtp attribute - Authors: - Alfred Farrugia - Sandro Gauci - Latest vulnerable version: Asterisk 15.2.0 running chanpjsip - References: AST-2018-003 - Enable Security Advisory: - Vendor Advisory: - Timeline: - Issue reported to vendor:...