FreeBSD : asterisk -- Buffer overflow in pjproject header parsing can cause crash in Asterisk (19b052c9-c533-11e7-8da5-001999f8d30b)

high Nessus Plugin ID 104487

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The Asterisk project reports :

By carefully crafting invalid values in the Cseq and the Via header port, pjprojects packet parsing code can create strings larger than the buffer allocated to hold them. This will usually cause Asterisk to crash immediately. The packets do not have to be authenticated.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 104487

File Name: freebsd_pkg_19b052c9c53311e78da5001999f8d30b.nasl

Version: 3.5

Type: local

Family: FreeBSD Local Security Checks

Published: 11/10/2017

Updated: 1/4/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:pjsip-extsrtp, p-cpe:/a:freebsd:freebsd:asterisk13, p-cpe:/a:freebsd:freebsd:pjsip

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 11/9/2017

Vulnerability Publication Date: 10/5/2017

Detections

Analytics