An issue was discovered in Asterisk Open Source 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1. If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the parameters. This does NOT require the endpoint to have Opus configured in Asterisk. This also does not require the endpoint to be authenticated. If guest is enabled for chan_sip or anonymous in chan_pjsip an SDP offer or answer is still processed and the crash occurs.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Asterisk Open Source 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1.
    If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a
    space the code responsible for parsing will recursively call itself until it crashes. This occurs as the
    code does not properly handle spaces separating the parameters. This does NOT require the endpoint to have
    Opus configured in Asterisk. This also does not require the endpoint to be authenticated. If guest is
    enabled for chan_sip or anonymous in chan_pjsip an SDP offer or answer is still processed and the crash
    occurs. (CVE-2016-9937)

According to its SIP banner, the version of Asterisk running on the remote host is 13.12.x prior to 13.13.1 or 14.x prior to 14.2.1. It is, therefore, affected by a denial of service vulnerability in the Opus codec when handling SDP offer or answer requests due to improper parsing of format parameters when they are separated by space characters. An unauthenticated, remote attacker can exploit this, via a specially crafted request, to cause the parser to recursively call itself until it crashes.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
400949	Alpine: multiple asterisk packages: security update to 14.2.0-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400949	Alpine: multiple asterisk packages: security update to 14.2.0-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
95926	Asterisk Opus Codec DoS (AST-2016-008)	Nessus	Misc.	high

Detections

Analytics

CVE-2016-9937

high

Tenable Plugins

high

high

high