PT-2021-6449 · Asterisk · Asterisk

Ipoddubny + 1 · Published 2021-04-06 · Updated 2021-08-07 · CVE-2021-31878

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 16.19.1 Asterisk versions prior to 18.5.1

Description The issue is related to the incorrect handling of a re-INVITE after a BYE request has been sent. This can be exploited by a remote attacker, allowing them to cause a denial of service. The exploitation requires a re-INVITE without SDP to be received after Asterisk has sent a BYE request.

Recommendations For Asterisk versions prior to 16.19.1, update to version 16.19.1 or later. For Asterisk versions prior to 18.5.1, update to version 18.5.1 or later.

Exploit

Fix

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BDU:2022-01652

CVE-2021-31878

Affected Products

Asterisk

References · 12

• 🔥 https://issues.asterisk.org/jira/browse/ASTERISK-29381 · Exploit
• http://packetstormsecurity.com/files/163638/Asterisk-Project-Security-Advisory-AST-2021-007.html · Patch
• http://seclists.org/fulldisclosure/2021/Jul/48 · Patch
• https://bdu.fstec.ru/vul/2022-01652 · Security Note
• https://osv.dev/vulnerability/CVE-2021-31878 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-31878 · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2021-007.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-31878 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-31878 · Security Note
• https://ubuntu.com/security/CVE-2021-31878 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-31878 · Security Note
• https://downloads.digium.com/pub/security/AST-2021-007.html · Vendor Advisory