PT-2022-23927 · Sangoma+1 · Asterisk+1

Published 2020-07-06 · Updated 2023-02-24 · CVE-2022-37325

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Sangoma Asterisk versions 16.28.0 and earlier, 17.x, 18.x through 18.14.0, and 19.x through 19.6.0

Description The issue arises from an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE, which can cause a crash.

Recommendations For versions 16.28.0 and earlier, 17.x, 18.x through 18.14.0, and 19.x through 19.6.0, consider updating to a version later than 19.6.0 to resolve the issue. As a temporary workaround, consider restricting access to the ooq931.c file in the addons/ooh323c/src directory until a patch is available. Avoid processing incoming Setup messages with malformed Calling or Called Party IE in the affected ooq931.c file until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2020-2313

CVE-2022-37325

DLA-3335-1

DSA-5358-1

Affected Products

Alt Linux

Asterisk

References · 16

• https://osv.dev/vulnerability/DLA-3335-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-37325 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-37325 · Vendor Advisory
• https://downloads.asterisk.org/pub/security/AST-2022-007.html · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-37325 · Vendor Advisory
• https://debian.org/security/2023/dsa-5358 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37325 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-37325 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-37325 · Security Note
• https://osv.dev/vulnerability/DSA-5358-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-37325 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-37325 · Vendor Advisory
• https://security.alpinelinux.org/vuln/CVE-2022-37325 · Note
• https://t.me/cibsecurity/54027 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2023/02/msg00029.html · Note