An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk     versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via     a specially crafted SDP protocol violation. (CVE-2019-7251)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk
    versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via
    a specially crafted SDP protocol violation. (CVE-2019-7251)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk
    versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via
    a specially crafted SDP protocol violation. (CVE-2019-7251)

  - Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0
    and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE
    message. (CVE-2019-12827)

  - An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x
    through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while
    handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing
    T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38
    re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL
    stream and another media stream containing only a codec (which is not permitted according to the chan_sip
    configuration). (CVE-2019-13161)

  - res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger
    a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash
    occurs because of a NULL session media object dereference. (CVE-2019-15297)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1
    allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a
    buffer size is supposed to match an expanded length but actually matches a compressed length.
    (CVE-2018-19278)

  - An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk
    versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via
    a specially crafted SDP protocol violation. (CVE-2019-7251)

  - Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0
    and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE
    message. (CVE-2019-12827)

  - An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x
    through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while
    handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing
    T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38
    re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL
    stream and another media stream containing only a codec (which is not permitted according to the chan_sip
    configuration). (CVE-2019-13161)

  - res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger
    a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash
    occurs because of a NULL session media object dereference. (CVE-2019-15297)

According to its SIP banner, the version of Asterisk running on the remote host is 15.x prior to 15.7.2, 16.x prior to 16.2.1. It is therefore, affected by an error related to handling SDP traffic and RTP negotiation described in AST-2019-001. This error allows denial of service attacks.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Asterisk project reports :

When Asterisk makes an outgoing call, a very specific SDP protocol violation by the remote party can cause Asterisk to crash.

ID	Name	Product	Family	Severity
252376	Linux Distros Unpatched Vulnerability : CVE-2019-7251	Nessus	Misc.	medium
423699	Alpine: multiple asterisk packages: security update to 16.3.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
423699	Alpine: multiple asterisk packages: security update to 16.3.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
403577	Alpine: asterisk: security update to 15.7.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	medium
403577	Alpine: asterisk: security update to 15.7.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	medium
403575	Alpine: asterisk: security update to 15.6.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403575	Alpine: asterisk: security update to 15.6.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
122670	Asterisk 15.x < 15.7.2 / 16.x < 16.2.1 DoS (AST-2019-001)	Nessus	Misc.	medium
122572	FreeBSD : asterisk -- Remote crash vulnerability with SDP protocol violation (be0e3817-3bfe-11e9-9cd6-001999f8d30b)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2019-7251

medium

Tenable Plugins

medium

medium

medium

medium

medium

high

high

medium

medium