[SECURITY] Fedora 27 Update: asterisk-14.7.4-1.fc27

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

Fedora 26 : asterisk (2017-38fbcdffc3)

Update to upstream 13.18.4 release to address AST-2017-012/CVE-2017-17664 security issue Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

DEBIAN-CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

Authentication flaw

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

UBUNTU-CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

CVE-2017-17850: Improper Input Validation

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

[SECURITY] Fedora 26 Update: asterisk-13.18.4-1.fc26

Asterisk is a complete PBX in software. It runs on Linux and provides all of the features you would expect from a PBX and more. Asterisk does voice over IP in three protocols, and can interoperate with almost all standards-based telephony equipment using relatively inexpensive hardware...

FreeBSD : asterisk -- Crash in PJSIP resource when missing a contact header (2a3bc6ac-e7c6-11e7-a90b-001999f8d30b)

The Asterisk project reports : A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and using the PJSIP channel driver, it would cause Asterisk to crash. The severity of this vulnerability is...

Digium Asterisk PJSIP Channel Driver Denial of Service Vulnerability

Digium Asterisk is a set of open source telephone exchange PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, interactive voice response IVR, etc. PJSIP Channel Driver is one of the PJSIP drivers. A security vulnerability...

PT-2017-15045

Name of the Vulnerable Software and Affected Versions Asterisk versions 13.18.4 and older Asterisk versions 14.7.4 and older Asterisk versions 15.1.4 and older Asterisk versions 13.18-cert1 and older Description An issue was discovered where certain SIP messages can cause Asterisk to crash if the...

CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

CVE-2017-17850

CVE-2017-17850 affects Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. If a SIP request creates a dialog and the SIP contact header is missing while using the PJSIP channel driver, Asterisk may crash. Authentication reduces risk by requiring prior author...

CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

CVE-2017-17850

An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel...

Asterisk 13.x < 13.18.4 / 14.x < 14.7.4 / 15.x < 15.1.4 / 13.13 < 13.13-cert9 Improper Memory Storage Remote DoS (AST-2017-012)

According to its SIP banner, the version of Asterisk running on the remote host is 13.x prior to 13.18.4, 14.x prior to 14.7.4, 15.x prior to 15.1.4, or 13.13 prior to 13.13-cert9. It is therefore, affected by an improper memory storage remote denial of service attack as described in AST-2017-012...

Digium Asterisk Open Source and Certified Asterisk Remote Denial of Service Vulnerabilities

Digium Asterisk Open Source and Certified Asterisk are both open source telephone exchange PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, and interactive voice response IVR. A remote denial of service vulnerability exis...