PT-2018-17999 · Sangoma · Asterisk

Sébastien Duthil · Publicado 2018-02-22 · Atualizado 2018-03-21 · CVE-2018-7285

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk versions 15.x through 15.2.1

Description A NULL pointer access issue was discovered in the RTP support of Asterisk. The issue arises when an RTP packet is received and the internal registry of dynamic codecs and desired payload numbers is consulted. If the payload number corresponds to a codec of a different type than the RTP stream, a crash can occur if no stream of that type has been negotiated. This is due to the code incorrectly assuming that a stream of that type would always exist.

Recommendations For Asterisk versions 15.x through 15.2.1, update to a version that contains a fix for this issue to prevent potential crashes.

Correção

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2018-7285

Produtos afetados

Asterisk

Referências · 6

• http://securityfocus.com/bid/103149 · Nota
• http://downloads.asterisk.org/pub/security/AST-2018-001.html · Aviso do Fabricante
• http://securitytracker.com/id/1040415 · Nota
• https://osv.dev/vulnerability/CVE-2018-7285 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7285 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7285 · Nota de Segurança