PT-2018-18000 · Sangoma · Asterisk

Alfred Farrugia + 1 · Published 2018-02-22 · Updated 2019-10-03 · CVE-2018-7286

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk versions 13.19.1 and earlier, 14.x through 14.7.5, and 15.x through 15.2.1 Certified Asterisk versions 13.18-cert2 and earlier

Description An issue allows remote authenticated users to crash Asterisk by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection, resulting in a segmentation fault.

Recommendations For Asterisk versions 13.19.1 and earlier, consider restricting access to the res pjsip module to minimize the risk of exploitation until a patch is available. For Asterisk versions 14.x through 14.7.5, restrict the use of SIP INVITE messages on TCP or TLS connections to prevent crashes. For Asterisk versions 15.x through 15.2.1, avoid sudden closure of TCP or TLS connections after sending SIP INVITE messages. For Certified Asterisk versions 13.18-cert2 and earlier, temporarily disable the res pjsip module to prevent crashes until a patch is available.

Exploit

Fix

Related Identifiers

CVE-2018-7286

DSA-4320-1

Affected Products

Asterisk

References · 23

• 🔥 https://exploit-db.com/exploits/44181 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17281 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7286 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-7286 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7284 · Security Note
• https://security-tracker.debian.org/tracker/source-package/asterisk · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-7286 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4320-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-7286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7286 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12227 · Security Note
• https://issues.asterisk.org/jira/browse/ASTERISK-27618 · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2018-005.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7286 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-7286 · Security Note