Alpine: multiple asterisk packages: security update to 11.2.1-r0 (deprecated)

high Tenable Cloud Security Plugin ID 401179

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before
11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition (BE) C.3.x before
C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones exhibits different
behavior for invalid INVITE, SUBSCRIBE, and REGISTER transactions depending on whether the user account
exists, which allows remote attackers to enumerate account names by (1) reading HTTP status codes, (2)
reading additional text in a 403 (aka Forbidden) response, or (3) observing whether certain
retransmissions occur. (CVE-2013-2264)

- Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2
allows remote attackers to execute arbitrary code via a long sprop-parameter-sets H.264 media attribute in
a SIP Session Description Protocol (SDP) header. (CVE-2013-2685)

- main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and
11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones
10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which
allows remote attackers to conduct stack-consumption attacks and cause a denial of service (daemon crash)
via a crafted HTTP POST request. NOTE: this vulnerability exists because of an incorrect fix for
CVE-2012-5976. (CVE-2013-2686)

Plugin Details

Severity: High

ID: 401179

Version: Revision 1.22

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 1/17/2024

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2013-2685

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2013-2686

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 3/28/2013

Vulnerability Publication Date: 2/21/2013

Reference Information

CVE: CVE-2013-2264, CVE-2013-2685, CVE-2013-2686

BID: 58756, 58760, 58764

IAVA: 2013-A-0070-S

Detections

Analytics