Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed length.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1
    allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a
    buffer size is supposed to match an expanded length but actually matches a compressed length.
    (CVE-2018-19278)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1
    allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a
    buffer size is supposed to match an expanded length but actually matches a compressed length.
    (CVE-2018-19278)

  - An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk
    versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via
    a specially crafted SDP protocol violation. (CVE-2019-7251)

  - Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0
    and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE
    message. (CVE-2019-12827)

  - An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x
    through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while
    handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing
    T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38
    re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL
    stream and another media stream containing only a codec (which is not permitted according to the chan_sip
    configuration). (CVE-2019-13161)

  - res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger
    a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash
    occurs because of a NULL session media object dereference. (CVE-2019-15297)

According to its SIP banner, the version of Asterisk running on the remote host is 15.x prior to 15.6.2, 16.x prior to 16.0.1. It is therefore, affected by an error related to the functions 'dns_srv' and 'dns_naptr' described in AST-2018-010. This error allows denial of service attacks.

Also note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
423679	Alpine: multiple asterisk packages: security update to 15.7.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
423679	Alpine: multiple asterisk packages: security update to 15.7.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
403575	Alpine: asterisk: security update to 15.6.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403575	Alpine: asterisk: security update to 15.6.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
118974	Asterisk 15.x < 15.6.2 / 16.x < 16.0.1 DoS (AST-2018-010)	Nessus	Misc.	high

Detections

Analytics

CVE-2018-19278

high

Tenable Plugins

high

high

high

high

high