An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.

vendor_unpatched cve-2021-32558: Unpatched CVEs for Ubuntu Linux (cve-2021-32558)

The remote host is affected by the vulnerability described in GLSA-202412-03 (Asterisk: Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced     below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4999 advisory.

  - An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4,     and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a     packet that contains an unsupported media format, a crash can occur. (CVE-2021-32558)

  - PJSIP is a free and open source multimedia communication library written in C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there     are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due     to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed     during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They     cause a crash, resulting in a denial of service. These are fixed in version 2.11.1. (CVE-2021-32686)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2729 advisory.

    It was discovered that there was an issue in the Asterisk telephony system. If the IAX2 channel driver     received a packet that contained an unsupported media format, a crash could have occured. CVE-2021-32558     An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4,     and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a     packet that contains an unsupported media format, a crash can occur. For Debian 9 Stretch, these problems     have been fixed in version 1:13.14.1~dfsg-2+deb9u5. We recommend that you upgrade your asterisk packages.
    In addition, Asterisk are tracking this issue as AST-2021-008 Further information about Debian LTS     security advisories, how to apply these updates to your system and frequently asked questions can be found     at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Asterisk project reports :

If the IAX2 channel driver receives a packet that contains an unsupported media format it can cause a crash to occur in Asterisk.

ID	Name	Product	Family	Severity
212188	GLSA-202412-03 : Asterisk: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
154818	Debian DSA-4999-1 : asterisk - security update	Nessus	Debian Local Security Checks	high
152215	Debian DLA-2729-1 : asterisk - LTS security update	Nessus	Debian Local Security Checks	high
152070	FreeBSD : asterisk -- Remote crash when using IAX2 channel driver (fb3455be-ebf6-11eb-aef1-0897988a1c07)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2021-32558

high

Tenable Plugins

Coming Soon

critical

high

high

high