PT-2018-14899 · Digium+1 · Asterisk+1

Jan Hoffmann + 1 · Publicado 2018-11-14 · Atualizado 2019-06-29 · CVE-2018-19278

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Digium Asterisk versions 15.x through 15.6.1 Digium Asterisk versions 16.x through 16.0.0

Description A buffer overflow issue exists in the DNS SRV and NAPTR lookups. This allows remote attackers to crash the system via a specially crafted DNS SRV or NAPTR response. The issue arises because a buffer size is supposed to match an expanded length but actually matches a compressed length.

Recommendations For Digium Asterisk versions 15.x through 15.6.1, update to version 15.6.2 or later. For Digium Asterisk versions 16.x through 16.0.0, update to version 16.0.1 or later.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2019-2182

CVE-2018-19278

Produtos afetados

Alt Linux

Asterisk

Referências · 12

• 🔥 https://issues.asterisk.org/jira/browse/ASTERISK-28127 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19278 · Nota de Segurança
• https://security.alpinelinux.org/vuln/CVE-2018-19278 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19278 · Nota de Segurança
• https://downloads.asterisk.org/pub/security/AST-2018-010.html · Aviso do Fabricante
• https://errata.altlinux.org/ALT-PU-2019-2182 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19278 · Nota
• https://osv.dev/vulnerability/CVE-2018-19278 · Aviso do Fabricante
• https://packages.altlinux.org/ru/vuln/CVE-2018-19278 · Nota
• https://osv.dev/vulnerability/ALPINE-CVE-2018-19278 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7251 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12827 · Nota de Segurança