CVE-2012-3863 in Asterisk
Summary
by MITRE
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a provisional response to a SIP reINVITE request, which allows remote authenticated users to cause a denial of service (RTP port exhaustion) via sessions that lack final responses.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/05/2021
The vulnerability identified as CVE-2012-3863 represents a critical flaw in the Session Initiation Protocol handling within various versions of Asterisk telephony software. This issue affects multiple product lines including the open source Asterisk 1.8.x versions before 1.8.13.1, 10.x versions before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones. The flaw specifically resides in the channels/chan_sip.c component which manages SIP channel operations and is classified under CWE-400, indicating improper handling of input that could lead to resource exhaustion.
The technical mechanism of this vulnerability involves the improper processing of provisional responses to SIP reINVITE requests. When a SIP reINVITE is sent to establish or modify a session, the system should properly handle both provisional and final responses to maintain session state consistency. However, in affected versions, when a provisional response is received without a corresponding final response, the system fails to correctly manage the RTP port allocation and session cleanup processes. This creates a scenario where RTP ports remain in a limbo state, continuously allocated but never properly released, leading to a gradual exhaustion of available RTP ports.
The operational impact of this vulnerability is significant as it enables remote authenticated attackers to perform denial of service attacks against SIP-based telephony systems. The attack vector requires only authentication to the system, making it particularly dangerous in environments where SIP authentication is implemented but not properly secured. The RTP port exhaustion ultimately prevents new sessions from being established, effectively rendering the telephony service unavailable to legitimate users. This vulnerability directly maps to ATT&CK technique T1499.004, which involves network denial of service attacks, and represents a classic resource exhaustion attack pattern.
The exploitation of this vulnerability can be executed by an authenticated user who sends a SIP reINVITE request with a provisional response that lacks a final response. This malformed interaction causes the Asterisk system to continuously allocate RTP ports without proper cleanup, eventually consuming all available ports in the system's RTP port pool. The impact extends beyond simple service disruption as it can affect business continuity for organizations relying on SIP-based communication systems, particularly those with high call volumes or mission-critical telephony requirements.
Organizations should implement immediate mitigations including upgrading to patched versions of Asterisk software, specifically versions 1.8.13.1, 10.5.2, and their respective certified editions. Additionally, network administrators should consider implementing rate limiting on SIP reINVITE requests and monitoring for unusual patterns of provisional responses that might indicate exploitation attempts. The vulnerability demonstrates the importance of proper state management in telephony systems and highlights the need for comprehensive input validation and resource cleanup mechanisms in SIP protocol implementations. This issue underscores the critical nature of maintaining up-to-date telephony software and implementing proper access controls to prevent unauthorized exploitation of such vulnerabilities.