CVE-2019-13161 in Asterisk Open Source
Summary
by MITRE
An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/26/2023
This vulnerability exists within the Asterisk telephony platform, specifically in the chan_sip module responsible for handling Session Initiation Protocol communications. The issue manifests as a pointer dereference flaw that occurs during Session Description Protocol (SDP) negotiation processes, particularly when managing T.38 re-invite requests. The vulnerability affects multiple versions including Asterisk Open Source through 13.27.0, 14.x, 15.x through 15.7.2, 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3, indicating a widespread impact across the Asterisk ecosystem. The flaw represents a classic buffer over-read condition that can lead to application instability and system crashes.
The technical exploitation requires specific conditions to be met where an attacker must first trigger the chan_sip module to initiate a T.38 re-invite request to the target system. Once this initial request is sent, the attacker must respond with an SDP answer that contains malformed media stream information. The malicious SDP answer includes both a T.38 UDPTL stream and another media stream containing only a codec, which violates the configuration parameters established by the chan_sip module. This configuration mismatch creates a scenario where the module attempts to dereference a pointer to memory that has not been properly allocated or initialized, leading to a segmentation fault and subsequent application crash. The vulnerability is categorized under CWE-476 as a NULL pointer dereference, which represents a fundamental memory management error that can be exploited to cause denial of service conditions.
The operational impact of this vulnerability extends beyond simple service disruption, as it can be leveraged to create persistent denial of service attacks against telephony systems. When exploited successfully, the crash can cause the Asterisk service to terminate unexpectedly, requiring manual intervention for restart and potentially disrupting ongoing communications. This vulnerability is particularly concerning for organizations relying on Asterisk for mission-critical telephony services, as it can be triggered remotely without authentication requirements. The attack vector aligns with ATT&CK technique T1499.004 for network denial of service, and represents a common exploitation pattern targeting telecommunications infrastructure. Organizations using Asterisk systems may experience complete service outages until the application is restarted, with potential cascading effects on dependent services that rely on telephony functionality.
Mitigation strategies should focus on immediate patching of affected Asterisk versions to the latest stable releases that contain fixes for this pointer dereference issue. System administrators should also implement network-level protections such as rate limiting and filtering of suspicious SDP packets to prevent exploitation attempts. The chan_sip module configuration should be reviewed to ensure proper validation of incoming SDP answers and to restrict potentially dangerous media stream combinations. Additionally, monitoring systems should be enhanced to detect unusual crash patterns and abnormal SDP negotiation behaviors that could indicate exploitation attempts. Organizations should also consider implementing intrusion detection systems that can identify and alert on known attack signatures targeting this specific vulnerability. Regular security assessments of telephony infrastructure and adherence to security best practices for VoIP systems are essential for preventing exploitation of similar memory corruption vulnerabilities in the broader Asterisk ecosystem.