PT-2016-7883 · Digium · Asterisk

Jorgen + 1 · Published 2016-12-12 · Updated 2017-07-27 · CVE-2016-9937

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 13.12.x through 13.13.0 Asterisk Open Source versions 14.x through 14.2.0

Description An issue was discovered where the code responsible for parsing SDP offers or answers with the Opus codec and format parameters separated by spaces will recursively call itself until it crashes. This occurs because the code does not properly handle spaces separating the parameters. The crash can happen without the endpoint having Opus configured in Asterisk and without the endpoint being authenticated. If guest is enabled for chan sip or anonymous in chan pjsip, an SDP offer or answer is still processed, leading to the crash.

Recommendations For Asterisk Open Source versions 13.12.x through 13.13.0, update to version 13.13.1 or later. For Asterisk Open Source versions 14.x through 14.2.0, update to version 14.2.1 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2016-9937

Affected Products

Asterisk

References · 9

• http://downloads.asterisk.org/pub/security/AST-2016-008-13.diff · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2016-008-14.diff · Vendor Advisory
• https://issues.asterisk.org/jira/browse/ASTERISK-26579 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9937 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9937 · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2016-008.html · Vendor Advisory
• http://securityfocus.com/bid/94792 · Note
• http://securitytracker.com/id/1037407 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9937 · Note