PT-2019-18481 · Sangoma+1 · Asterisk+1

Sotiris Ganouris + 1 · Published 2019-03-28 · Updated 2019-06-29 · CVE-2019-7251

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk versions 15.7.1 and earlier Asterisk versions 16.1.1 and earlier

Description The issue is related to an Integer Signedness problem in the res pjsip sdp rtp module, which can be exploited by remote authenticated users. This can be done by sending a specially crafted SDP protocol violation, leading to a crash of Asterisk.

Recommendations For Asterisk versions 15.7.1 and earlier, update to a version later than 15.7.1 to resolve the issue. For Asterisk versions 16.1.1 and earlier, update to a version later than 16.1.1 to resolve the issue.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2019-2182

CVE-2019-7251

Affected Products

Alt Linux

Asterisk

References · 18

• https://ubuntu.com/security/CVE-2019-7251 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-7251 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19278 · Security Note
• https://issues.asterisk.org/jira/browse/ASTERISK-28260 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-7251 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2019-7251 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-7251 · Vendor Advisory
• https://downloads.asterisk.org/pub/security/AST-2019-001.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7251 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12827 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-7251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7251 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7251 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2019-2182 · Vendor Advisory
• https://packages.altlinux.org/ru/vuln/CVE-2019-7251 · Note