PT-2018-14899 · Digium+1 · Asterisk+1

Jan Hoffmann + 1 · Published 2018-11-14 · Updated 2019-06-29 · CVE-2018-19278

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Digium Asterisk versions 15.x through 15.6.1 Digium Asterisk versions 16.x through 16.0.0

Description A buffer overflow issue exists in the DNS SRV and NAPTR lookups. This allows remote attackers to crash the system via a specially crafted DNS SRV or NAPTR response. The issue arises because a buffer size is supposed to match an expanded length but actually matches a compressed length.

Recommendations For Digium Asterisk versions 15.x through 15.6.1, update to version 15.6.2 or later. For Digium Asterisk versions 16.x through 16.0.0, update to version 16.0.1 or later.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

ALT-PU-2019-2182

CVE-2018-19278

Affected Products

Alt Linux

Asterisk

References · 12

• 🔥 https://issues.asterisk.org/jira/browse/ASTERISK-28127 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19278 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19278 · Security Note
• https://downloads.asterisk.org/pub/security/AST-2018-010.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2182 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-19278 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2018-19278 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7251 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12827 · Security Note
• https://security.alpinelinux.org/vuln/CVE-2018-19278 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19278 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2018-19278 · Note