PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch (2.13.1).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - PJSIP is a free and open source multimedia communication library written in C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when     parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications     that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch     (2.13.1). (CVE-2022-23537)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - PJSIP is a free and open source multimedia communication library written in C language implementing
    standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when
    parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications
    that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch
    (2.13.1). (CVE-2022-23537)

  - Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and
    prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update'
    functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the
    new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally
    exploitable, unless dialplan is explicitly written to update a header based on data from an outside
    source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available
    at commit a1ca0268254374b515fa5992f01340f7717113fa. (CVE-2023-37457)

  - Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions
    18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, it is possible to read any
    arbitrary file even when the `live_dangerously` is not enabled. This allows arbitrary files to be read.
    Asterisk versions 18.20.1, 20.5.1, and 21.0.1, as well as certified-asterisk prior to 18.9-cert6, contain
    a fix for this issue. (CVE-2023-49294)

  - Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions
    18.20.1, 20.5.1, and 21.0.1; as well as certified-asterisk prior to 18.9-cert6; Asterisk is susceptible to
    a DoS due to a race condition in the hello handshake phase of the DTLS protocol when handling DTLS-SRTP
    for media setup. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during
    the attack. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable Asterisk
    servers for calls that rely on DTLS-SRTP. Commit d7d7764cb07c8a1872804321302ef93bf62cba05 contains a fix,
    which is part of versions 18.20.1, 20.5.1, 21.0.1, amd 18.9-cert6. (CVE-2023-49786)

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3887 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3887-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                  Roberto C. Snchez     September 14, 2024                            https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : ring     Version        : 20210112.2.b757bac~ds1-1+deb11u1     CVE ID         : CVE-2021-32686 CVE-2021-37706 CVE-2021-43299 CVE-2021-43300                      CVE-2021-43301 CVE-2021-43302 CVE-2021-43303 CVE-2021-43804                      CVE-2021-43845 CVE-2022-21722 CVE-2022-21723 CVE-2022-23537                      CVE-2022-23547 CVE-2022-23608 CVE-2022-24754 CVE-2022-24763                      CVE-2022-24764 CVE-2022-24793 CVE-2022-31031 CVE-2022-39244                      CVE-2023-27585

    Multiple vulnerabilities were found to affect ring, a secure and     distributed voice, video, and chat platform.

    CVE-2021-32686

        The embedded copy of pjproject is affected by this CVE.
        A race condition between callback and destroy, due to the accepted socket         having no group lock. Additionally, the SSL socket parent/listener may get         destroyed during handshake. Both issues were reported to happen         intermittently in heavy load TLS connections. They cause a crash, resulting         in a denial of service.

    CVE-2021-37706

        The embedded copy of pjproject is affected by this CVE.
        If the incoming STUN message contains an ERROR-CODE attribute, the header         length is not checked before performing a subtraction operation, potentially         resulting in an integer underflow scenario. This issue affects all users         that use STUN. A malicious actor located within the victim's network may         forge and send a specially crafted UDP (STUN) message that could remotely         execute arbitrary code on the victims machine.

    CVE-2021-43299

        The embedded copy of pjproject is affected by these CVEs.
        An attacker-controlled 'filename' argument may cause a buffer overflow since         it is copied to a fixed-size stack buffer without any size validation.

    CVE-2021-43300

        The embedded copy of pjproject is affected by these CVEs.
        An attacker-controlled 'filename' argument may cause a buffer overflow since         it is copied to a fixed-size stack buffer without any size validation.

    CVE-2021-43301

        The embedded copy of pjproject is affected by these CVEs.
        An attacker-controlled 'filename' argument may cause a buffer overflow since         it is copied to a fixed-size stack buffer without any size validation.

    CVE-2021-43302

        The embedded copy of pjproject is affected by these CVEs.
        An attacker-controlled 'filename' argument may cause a buffer overflow since         it is copied to a fixed-size stack buffer without any size validation.

    CVE-2021-43303

        The embedded copy of pjproject is affected by these CVEs.
        An attacker-controlled 'filename' argument may cause a buffer overflow since         it is copied to a fixed-size stack buffer without any size validation.

    CVE-2021-43804

        The embedded copy of pjproject is affected by this CVE.
        In affected versions if the incoming RTCP BYE message contains a reason's         length, this declared length is not checked against the actual received         packet size, potentially resulting in an out-of-bound read access.

    CVE-2021-43845

        The embedded copy of pjproject is affected by this CVE.
        If incoming RTCP XR message contain block, the data field is not checked         against the received packet size, potentially resulting in an out-of-bound         read access.

    CVE-2022-21722

        The embedded copy of pjproject is affected by this CVE.
        There are various cases where it is possible that certain incoming RTP/RTCP         packets can potentially cause out-of-bound read access.

    CVE-2022-21723

        The embedded copy of pjproject is affected by this CVE.
        Parsing an incoming SIP message that contains a malformed multipart can         potentially cause out-of-bound read access.

    CVE-2022-23537

        The embedded copy of pjproject is affected by this CVE.
        Buffer overread is possible when parsing a specially crafted STUN message         with unknown attribute.

    CVE-2022-23547

        The embedded copy of pjproject is affected by this CVE.
        Possible buffer overread when parsing a certain STUN message.

    CVE-2022-23608

        The embedded copy of pjproject is affected by this CVE.
        When in a dialog set (or forking) scenario, a hash key shared by multiple         UAC dialogs can potentially be prematurely freed when one of the dialogs is         destroyed . The issue may cause a dialog set to be registered in the hash         table multiple times (with different hash keys) leading to undefined         behavior such as dialog list collision which eventually leading to endless         loop.

    CVE-2022-24754

        The embedded copy of pjproject is affected by this CVE.
        There is a stack-buffer overflow vulnerability which only impacts PJSIP         users who accept hashed digest credentials (credentials with data_type         `PJSIP_CRED_DATA_DIGEST`).

    CVE-2022-24763

        The embedded copy of pjproject is affected by this CVE.
        A denial-of-service vulnerability affects PJSIP users that consume PJSIP's         XML parsing in their apps.

    CVE-2022-24764

        The embedded copy of pjproject is affected by this CVE.
        A stack buffer overflow vulnerability affects PJSUA2 users or users that         call the API `pjmedia_sdp_print(), pjmedia_sdp_media_print()`.

    CVE-2022-24793

        The embedded copy of pjproject is affected by this CVE.
        A buffer overflow vulnerability in affects applications that use PJSIP DNS         resolution.

    CVE-2022-31031

        The embedded copy of pjproject is affected by this CVE.
        A stack buffer overflow vulnerability affects PJSIP users that use STUN in         their applications, either by: setting a STUN server in their account/media         config in PJSUA/PJSUA2 level, or directly using `pjlib-util/stun_simple`         API.

    CVE-2022-39244

        The embedded copy of pjproject is affected by this CVE.
        The PJSIP parser, PJMEDIA RTP decoder, and PJMEDIA SDP parser are affeced         by a buffer overflow vulnerability. Users connecting to untrusted clients         are at risk.

    CVE-2023-27585

        The embedded copy of pjproject is affected by this CVE.
        A buffer overflow vulnerability affects applications that use PJSIP DNS         resolver.

    For Debian 11 bullseye, these problems have been fixed in version     20210112.2.b757bac~ds1-1+deb11u1.

    We recommend that you upgrade your ring packages.

    For the detailed security status of ring please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ring

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - PJSIP is a free and open source multimedia communication library written in C language implementing
    standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. Buffer overread is possible when
    parsing a specially crafted STUN message with unknown attribute. The vulnerability affects applications
    that uses STUN including PJNATH and PJSUA-LIB. The patch is available as a commit in the master branch
    (2.13.1). (CVE-2022-23537)

  - In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming
    Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a
    crash. (CVE-2022-37325)

  - A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2
    may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on
    a subscription via a reliable transport at the same time that Asterisk is also performing activity on that
    subscription. (CVE-2022-42705)

  - An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and
    certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to
    access files outside of the asterisk configuration directory, aka Directory Traversal. (CVE-2022-42706)

The remote Ubuntu 18.04 ESM / 20.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6422-1 advisory.

    It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     execute arbitrary code. (CVE-2021-37706)

    It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     cause a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS.

    (CVE-2021-43299, CVE-2021-43300, CVE-2021-43301, CVE-2021-43302,

    CVE-2021-43303, CVE-2021-43804, CVE-2021-43845, CVE-2022-21723,

    CVE-2022-23537, CVE-2022-23547, CVE-2022-23608, CVE-2022-24754, CVE-2022-24763, CVE-2022-24764,     CVE-2022-24793, CVE-2022-31031, CVE-2022-39244)

    It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-21722)

    It was discovered that Ring incorrectly handled certain inputs. If a user or an automated system were     tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to     cause a denial of service. (CVE-2023-27585)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3549 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3549-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     August 29, 2023                               https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : ring     Version        : 20190215.1.f152c98~ds1-1+deb10u2     CVE ID         : CVE-2021-37706 CVE-2021-43299 CVE-2021-43300                      CVE-2021-43301 CVE-2021-43302 CVE-2021-43303                      CVE-2021-43804 CVE-2021-43845 CVE-2022-21722                      CVE-2022-21723 CVE-2022-23537 CVE-2022-23547                      CVE-2022-23608 CVE-2022-24754 CVE-2022-24763                      CVE-2022-24764 CVE-2022-24793 CVE-2022-31031                      CVE-2022-39244 CVE-2023-27585


    Several issue have been found in ring/jami, a secure and distributed     voice, video and chat platform.
    The issues are about missing boundary checks, resulting in out-of-bound     read access, buffer overflow or denial-of-service.



    For Debian 10 buster, these problems have been fixed in version     20190215.1.f152c98~ds1-1+deb10u2.

    We recommend that you upgrade your ring/jami packages.

    For the detailed security status of ring please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/ring

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3335 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3335-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     February 22, 2023                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : asterisk     Version        : 1:16.28.0~dfsg-0+deb10u2     CVE ID         : CVE-2022-23537 CVE-2022-23547 CVE-2022-31031 CVE-2022-37325                      CVE-2022-39244 CVE-2022-39269 CVE-2022-42705 CVE-2022-42706

    Multiple security vulnerabilities have been discovered in Asterisk, an Open     Source Private Branch Exchange. Buffer overflows and other programming errors     could be exploited for launching a denial of service attack or the execution of     arbitrary code.

    For Debian 10 buster, these problems have been fixed in version     1:16.28.0~dfsg-0+deb10u2.

    We recommend that you upgrade your asterisk packages.

    For the detailed security status of asterisk please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/asterisk

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5358 advisory.

    Multiple security vulnerabilities have been discovered in Asterisk, an Open Source Private Branch     Exchange. Buffer overflows and other programming errors could be exploited for launching a denial of     service attack or the execution of arbitrary code. For the stable distribution (bullseye), these problems     have been fixed in version 1:16.28.0~dfsg-0+deb11u2. We recommend that you upgrade your asterisk packages.
    For the detailed security status of asterisk please refer to its security tracker page at:
    https://security-tracker.debian.org/tracker/asterisk

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
252365	Linux Distros Unpatched Vulnerability : CVE-2022-23537	Nessus	Misc.	critical
425703	Alpine: multiple asterisk packages: security update to 18.20.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
425703	Alpine: multiple asterisk packages: security update to 18.20.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
207275	Debian dla-3887 : jami - security update	Nessus	Debian Local Security Checks	critical
408227	Alpine: asterisk: security update to 18.20.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
408227	Alpine: asterisk: security update to 18.20.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
182792	Ubuntu 18.04 ESM / 20.04 LTS / 23.04 : Ring vulnerabilities (USN-6422-1)	Nessus	Ubuntu Local Security Checks	critical
180270	Debian dla-3549 : jami - security update	Nessus	Debian Local Security Checks	critical
171903	Debian dla-3335 : asterisk - security update	Nessus	Debian Local Security Checks	critical
171882	Debian DSA-5358-1 : asterisk - security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2022-23537

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical