CVE-2019-13161
Description
An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| digium certified_asterisk | 1.8.0.0, 1.8.1.0, 1.8.2.0, 1.8.3.0, 1.8.4.0, 1.8.5.0, 1.8.6.0, 1.8.7.0, 1.8.8.0, 1.8.9.0, 1.8.10.0, 1.8.11, 1.8.11.0, 1.8.12.0, 1.8.13.0, 1.8.14.0, 1.8.15, 1.8.28, 1.8.28.0, 11.0.0, 11.1.0, 11.2, 11.3.0, 11.4.0, 11.5.0, 11.6, 11.6.0, 13.1, 13.1.0, 13.8, 13.8.0, 13.13, 13.13-cert2 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.