FreeBSD : asterisk -- Outbound INVITE loop on challenge with different nonce (29b7f0be-1fb7-11eb-b9d4-001999f8d30b)

High Nessus Plugin ID 142535

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The Asterisk project reports :

If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur.

Solution

Update the affected packages.

See Also

https://downloads.asterisk.org/pub/security/AST-2020-002.html

http://www.nessus.org/u?ceaa7442

Plugin Details

Severity: High

ID: 142535

File Name: freebsd_pkg_29b7f0be1fb711ebb9d4001999f8d30b.nasl

Version: 1.1

Type: local

Published: 2020/11/06

Updated: 2020/11/06

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:asterisk13, p-cpe:/a:freebsd:freebsd:asterisk16, p-cpe:/a:freebsd:freebsd:asterisk18, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2020/11/05

Vulnerability Publication Date: 2020/11/05