PT-2021-5541 · Asterisk+2 · Asterisk+2

Michael Welk + 1 · Published 2021-07-26 · Updated 2025-02-13 · CVE-2021-32558

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Asterisk versions 13.x through 13.38.2 Asterisk versions 16.x through 16.19.0 Asterisk versions 17.x through 17.9.3 Asterisk versions 18.x through 18.5.0 Certified Asterisk versions prior to 16.8-cert10

Description The issue is related to insufficient input validation. If the IAX2 channel driver receives a packet containing an unsupported media format, a crash can occur, allowing a remote attacker to execute a denial-of-service (DoS) attack by sending a specially crafted request.

Recommendations For Asterisk versions 13.x through 13.38.2, update to version 13.38.3 or later. For Asterisk versions 16.x through 16.19.0, update to version 16.19.1 or later. For Asterisk versions 17.x through 17.9.3, update to version 17.9.4 or later. For Asterisk versions 18.x through 18.5.0, update to version 18.5.1 or later. For Certified Asterisk versions prior to 16.8-cert10, update to version 16.8-cert10 or later.

Exploit

Fix

Special Elements Injection

RCE

Weakness Enumeration

CWE-74

CWE-20

Related Identifiers

ALT-PU-2023-6874

ALT-PU-2025-2613

BDU:2021-06391

CVE-2021-32558

DLA-2729-1

DSA-4999-1

Affected Products

Alt Linux

Asterisk

Red Os

References · 25

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/asterisk_ami_originate_auth_rce.rb · Exploit
• 🔥 https://issues.asterisk.org/jira/browse/ASTERISK-29392 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2021-32558 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4999-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32558 · Security Note
• http://packetstormsecurity.com/files/163639/Asterisk-Project-Security-Advisory-AST-2021-008.html · Patch
• https://bdu.fstec.ru/vul/2021-06391 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32558 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2021-32558 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32558 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2729-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32558 · Vendor Advisory
• https://debian.org/security/2021/dsa-4999 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32558 · Security Note
• http://seclists.org/fulldisclosure/2021/Jul/49 · Patch