There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1
    allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a
    buffer size is supposed to match an expanded length but actually matches a compressed length.
    (CVE-2018-19278)

  - An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk
    versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via
    a specially crafted SDP protocol violation. (CVE-2019-7251)

  - Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0
    and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE
    message. (CVE-2019-12827)

  - An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x
    through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while
    handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing
    T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38
    re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL
    stream and another media stream containing only a codec (which is not permitted according to the chan_sip
    configuration). (CVE-2019-13161)

  - res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger
    a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash
    occurs because of a NULL session media object dereference. (CVE-2019-15297)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk
    versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via
    a specially crafted SDP protocol violation. (CVE-2019-7251)

  - Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0
    and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE
    message. (CVE-2019-12827)

  - An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x
    through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while
    handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing
    T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38
    re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL
    stream and another media stream containing only a codec (which is not permitted according to the chan_sip
    configuration). (CVE-2019-13161)

  - res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger
    a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash
    occurs because of a NULL session media object dereference. (CVE-2019-15297)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk
    versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via
    a specially crafted SDP protocol violation. (CVE-2019-7251)

The Asterisk project reports :

When Asterisk makes an outgoing call, a very specific SDP protocol violation by the remote party can cause Asterisk to crash.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk     versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via     a specially crafted SDP protocol violation. (CVE-2019-7251)

Note that Nessus relies on the presence of the package as reported by the vendor.

According to its SIP banner, the version of Asterisk running on the remote host is 15.x prior to 15.7.2, 16.x prior to 16.2.1. It is therefore, affected by an error related to handling SDP traffic and RTP negotiation described in AST-2019-001. This error allows denial of service attacks.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
403575	Alpine: asterisk: security update to 15.6.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
403577	Alpine: asterisk: security update to 15.7.4-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	medium
403577	Alpine: asterisk: security update to 15.7.4-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	medium
403575	Alpine: asterisk: security update to 15.6.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	10/31/2023	7/2/2026	high
423699	Alpine: multiple asterisk packages: security update to 16.3.0-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	4/4/2025	7/2/2026	medium
423699	Alpine: multiple asterisk packages: security update to 16.3.0-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	4/4/2025	7/2/2026	medium
122572	FreeBSD : asterisk -- Remote crash vulnerability with SDP protocol violation (be0e3817-3bfe-11e9-9cd6-001999f8d30b)	Nessus	FreeBSD Local Security Checks	3/4/2019	6/17/2024	medium
252376	Linux Distros Unpatched Vulnerability : CVE-2019-7251	Nessus	Misc.	8/20/2025	7/21/2026	medium
122670	Asterisk 15.x < 15.7.2 / 16.x < 16.2.1 DoS (AST-2019-001)	Nessus	Misc.	3/8/2019	3/7/2023	medium

Detections

Analytics

Plugins Search

high

medium

medium

high

medium

medium

medium

medium

medium