Detections
Analytics
FreeBSD : asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk (ee50726e-0319-11e6-aa86-001999f8d30b)
high Nessus Plugin ID 90556
Language:
Synopsis
The remote FreeBSD host is missing a security-related update.Description
The Asterisk project reports :Asterisk may crash when processing an incoming REGISTER request if that REGISTER contains a Contact header with a lengthy URI.
This crash will only happen for requests that pass authentication.
Unauthenticated REGISTER requests will not result in a crash occurring.
This vulnerability only affects Asterisk when using PJSIP as its SIP stack. The chan_sip module does not have this problem.
Solution
Update the affected package.See Also
http://downloads.asterisk.org/pub/security/AST-2016-004.html
Plugin Details
Severity: High
ID: 90556
File Name: freebsd_pkg_ee50726e031911e6aa86001999f8d30b.nasl
Version: 2.3
Type: local
Family: FreeBSD Local Security Checks
Published: 4/18/2016
Updated: 1/4/2021
Supported Sensors: Nessus
Vulnerability Information
CPE: p-cpe:/a:freebsd:freebsd:asterisk13, cpe:/o:freebsd:freebsd
Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info
Patch Publication Date: 4/15/2016
Vulnerability Publication Date: 1/19/2016