PT-2021-17107 · Sangoma+1 · Asterisk+1

Edvin Vidmar + 1 · Published 2021-02-19 · Updated 2025-02-13 · CVE-2021-26713

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Sangoma Asterisk versions prior to 16.16.1 Sangoma Asterisk versions 17.x prior to 17.9.2 Sangoma Asterisk versions 18.x prior to 18.2.1 Certified Asterisk versions prior to 16.8-cert6

Description A stack-based buffer overflow in res rtp asterisk.c allows an authenticated WebRTC client to cause an Asterisk crash by sending multiple hold/unhold requests in quick succession. This is caused by a signedness comparison mismatch.

Recommendations For Sangoma Asterisk versions prior to 16.16.1, update to version 16.16.1 or later. For Sangoma Asterisk versions 17.x prior to 17.9.2, update to version 17.9.2 or later. For Sangoma Asterisk versions 18.x prior to 18.2.1, update to version 18.2.1 or later. For Certified Asterisk versions prior to 16.8-cert6, update to version 16.8-cert6 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2023-6874

ALT-PU-2025-2613

CVE-2021-26713

Affected Products

Alt Linux

Asterisk

References · 11

• https://osv.dev/vulnerability/UBUNTU-CVE-2021-26713 · Vendor Advisory
• https://downloads.asterisk.org/pub/security/AST-2021-004.html · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-26713 · Vendor Advisory
• https://downloads.asterisk.org/pub/security · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-26713 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-26713 · Security Note
• https://issues.asterisk.org/jira/browse/ASTERISK-29205 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26713 · Security Note
• https://osv.dev/vulnerability/CVE-2021-26713 · Vendor Advisory
• https://security.alpinelinux.org/vuln/CVE-2021-26713 · Note
• https://t.me/cibsecurity/23885 · Telegram Post