what you don't know can hurt you

Asterisk Project Security Advisory - AST-2020-004

Asterisk Project Security Advisory - AST-2020-004
Posted Dec 23, 2020
Authored by Kevin Harwell, Mikhail Ivanov | Site asterisk.org

Asterisk Project Security Advisory - A crash can occur in Asterisk when a SIP 181 response is received that has a Diversion header, which contains a tel-uri.

tags | advisory
MD5 | 0b17669792f94478ab39dea3f00ba745

Asterisk Project Security Advisory - AST-2020-004

Change Mirror Download
               Asterisk Project Security Advisory - AST-2020-004

Product Asterisk
Summary Remote crash in res_pjsip_diversion
Nature of Advisory Denial of service
Susceptibility Remote authenticated sessions
Severity Moderate
Exploits Known No
Reported On December 02, 2020
Reported By Mikhail Ivanov
Posted On December 22, 2020
Last Updated On
Advisory Contact kharwell AT sangoma DOT com
CVE Name

Description A crash can occur in Asterisk when a SIP 181 response
is received that has a Diversion header, which
contains a tel-uri.
Modules Affected res_pjsip_diversion.c

Resolution Asterisk now ensures that if it receives a SIP 181 response
with a Diversion header that contains a tel-uri a crash does
not occur.

Affected Versions
Product Release Series
Asterisk Open Source 13.X 13.38.0
Asterisk Open Source 16.X 16.15.0
Asterisk Open Source 17.X 17.9.0
Asterisk Open Source 18.X 18.1.0

Corrected In
Product Release
Asterisk Open Source 13.38.1, 16.15.1, 17.9.1, 18.1.1

Patches
SVN URL Revision
The associated patches for AST-2020-003 also Asterisk 13, 16, 17, 18
fix this issue.

Links https://issues.asterisk.org/jira/browse/ASTERISK-29191
https://downloads.asterisk.org/pub/security/AST-2020-003.html

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2020-004.pdf and
http://downloads.digium.com/pub/security/AST-2020-004.html

Revision History
Date Editor Revisions Made
December 22, 2020 Kevin Harwell Initial revision

Asterisk Project Security Advisory - AST-2020-004
Copyright © 2020 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.
Login or Register to add favorites

File Archive:

December 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    18 Files
  • 2
    Dec 2nd
    11 Files
  • 3
    Dec 3rd
    23 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close