FreeBSD : asterisk -- Crash on SDP offer or answer from endpoint using Opus (9e6640fe-be3a-11e6-b04f-001999f8d30b)

This script is Copyright (C) 2016 Tenable Network Security, Inc.


Synopsis :

The remote FreeBSD host is missing a security-related update.

Description :

The Asterisk project reports :

If an SDP offer or answer is received with the Opus codec and with the
format parameters separated using a space the code responsible for
parsing will recursively call itself until it crashes. This occurs as
the code does not properly handle spaces separating the parameters.
This does NOT require the endpoint to have Opus configured in
Asterisk. This also does not require the endpoint to be authenticated.
If guest is enabled for chan_sip or anonymous in chan_pjsip an SDP
offer or answer is still processed and the crash occurs.

See also :

http://downloads.asterisk.org/pub/security/AST-2016-008.html
http://www.nessus.org/u?fe6fd4b6

Solution :

Update the affected package.

Risk factor :

High

Family: FreeBSD Local Security Checks

Nessus Plugin ID: 95693 ()

Bugtraq ID:

CVE ID:

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now