PT-2016-7884 · Sangoma · Asterisk

Walter Doekes · Published 2016-12-12 · Updated 2017-07-27 · CVE-2016-9938

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 11.x through 11.25.1 Asterisk Open Source versions 13.x through 13.13.1 Asterisk Open Source versions 14.x through 14.2.1 Certified Asterisk versions 11.x through 11.6-cert16 Certified Asterisk versions 13.x through 13.8-cert4

Description The issue is related to the chan sip channel driver, which has a liberal definition for whitespace when stripping content between a SIP header name and a colon character. This can cause problems when Asterisk is used with an authenticating SIP proxy, allowing an INVITE request into Asterisk without authentication. The result is that Asterisk can process calls from unvetted sources without any authentication.

Recommendations For Asterisk Open Source versions 11.x through 11.25.1, update to version 11.25.1 or later. For Asterisk Open Source versions 13.x through 13.13.1, update to version 13.13.1 or later. For Asterisk Open Source versions 14.x through 14.2.1, update to version 14.2.1 or later. For Certified Asterisk versions 11.x through 11.6-cert16, update to version 11.6-cert16 or later. For Certified Asterisk versions 13.x through 13.8-cert4, update to version 13.8-cert4 or later. As a temporary workaround, consider using chan pjsip instead of chan sip, or ensure that your proxy is dialog-aware to minimize the risk of exploitation.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2016-9938

Affected Products

Asterisk

References · 12

• https://cve.org/CVERecord?id=CVE-2016-9938 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9938 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-9938 · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2016-009.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-9938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9938 · Security Note
• https://ubuntu.com/security/CVE-2016-9938 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-9938 · Vendor Advisory
• http://securitytracker.com/id/1037408 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9938 · Note
• http://securityfocus.com/bid/94789 · Note
• https://issues.asterisk.org/jira/browse/ASTERISK-26433 · Note