Sangoma · Asterisk · CVE-2019-18790
**Name of the Vulnerable Software and Affected Versions**
Sangoma Asterisk versions 13.x through 13.29.1
Sangoma Asterisk versions 16.x through 16.6.1
Sangoma Asterisk versions 17.x through 17.0.0
Certified Asterisk versions 13.21 through cert4
**Description**
An issue was discovered in channels/chan sip.c that allows a SIP request to change a SIP peer's IP address without requiring a REGISTER or authentication details such as passwords. The only required information is the peer's name. This issue can lead to call hijacking and is only exploitable when the nat option is set to the default or auto force rport.
**Recommendations**
For Sangoma Asterisk versions 13.x through 13.29.1, update to version 13.29.2 or later.
For Sangoma Asterisk versions 16.x through 16.6.1, update to version 16.6.2 or later.
For Sangoma Asterisk versions 17.x through 17.0.0, update to version 17.0.1 or later.
For Certified Asterisk versions 13.21 through cert4, update to cert5 or later.
As a temporary workaround, consider changing the nat option from the default or auto force rport to a more secure setting until a patch is applied.