PT-2019-15667 · Sangoma+1 · Asterisk+1

Andrey V. T · Publicado 2019-11-22 · Atualizado 2022-05-13 · CVE-2019-18790

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Sangoma Asterisk versions 13.x through 13.29.1 Sangoma Asterisk versions 16.x through 16.6.1 Sangoma Asterisk versions 17.x through 17.0.0 Certified Asterisk versions 13.21 through cert4

Description An issue was discovered in channels/chan sip.c that allows a SIP request to change a SIP peer's IP address without requiring a REGISTER or authentication details such as passwords. The only required information is the peer's name. This issue can lead to call hijacking and is only exploitable when the nat option is set to the default or auto force rport.

Recommendations For Sangoma Asterisk versions 13.x through 13.29.1, update to version 13.29.2 or later. For Sangoma Asterisk versions 16.x through 16.6.1, update to version 16.6.2 or later. For Sangoma Asterisk versions 17.x through 17.0.0, update to version 17.0.1 or later. For Certified Asterisk versions 13.21 through cert4, update to cert5 or later. As a temporary workaround, consider changing the nat option from the default or auto force rport to a more secure setting until a patch is applied.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

ALT-PU-2020-2313

CVE-2019-18790

DLA-2017-1

DLA-2969-1

Produtos afetados

Alt Linux

Asterisk

Referências · 44

• https://osv.dev/vulnerability/DLA-2017-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15639 · Nota de Segurança
• https://bdu.fstec.ru/vul/2022-01086 · Nota de Segurança
• https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15297 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37325 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42705 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18790 · Nota
• https://t.me/cvenotify/28355 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-18790 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-18790 · Aviso do Fabricante
• https://safe-surf.ru/specialists/bulletins-nkcki/675928 · Nota de Segurança
• https://osv.dev/vulnerability/ALPINE-CVE-2019-18790 · Aviso do Fabricante
• https://asterisk.org/downloads/security-advisories · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2022-02209 · Nota de Segurança