CVE-2019-18790
Description
An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.
How to fix
- digium asterisk13.29.2, 16.6.2, 17.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| digium asterisk | 13.0.0 ≤ v < 13.29.2, 16.0.0 ≤ v < 16.6.2, 17.0.0 ≤ v < 17.0.1 | 13.29.2, 16.6.2, 17.0.1 |
| digium certified_asterisk | 13.21.0 | — |
| debian debian_linux | 8.0, 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.