Asterisk Open Source up to 15.7.1/16.2.0 integer overflow

Summaryinfo

A vulnerability labeled as problematic has been found in Asterisk Open Source up to 15.7.1/16.2.0. This affects an unknown part. Executing a manipulation can lead to integer overflow. This vulnerability appears as CVE-2019-7251. The attack may be performed from remote. There is no available exploit. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in Asterisk Open Source up to 15.7.1/16.2.0 (Communications System). It has been declared as problematic. This vulnerability affects an unknown part. The manipulation with an unknown input leads to a integer overflow vulnerability. The CWE definition for the vulnerability is CWE-190. The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control. As an impact it is known to affect availability. CVE summarizes:

An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation.

The bug was discovered 02/28/2019. The weakness was presented 02/28/2019 by Sotiris Ganouris as AST-2019-001: Remote crash vulnerability with SDP protocol violation as confirmed mailinglist post (Full-Disclosure). The advisory is shared for download at seclists.org. The public release was coordinated in cooperation with the vendor. This vulnerability was named CVE-2019-7251 since 01/31/2019. The exploitation appears to be easy. The attack can be initiated remotely. A single authentication is necessary for exploitation. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 35 days. During that time the estimated underground price was around $0-$5k.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at downloads.asterisk.org.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Communications System

Vendor

• Asterisk

Name

• Open Source

Version

• 15.7.0
• 15.7.1
• 16.0
• 16.1
• 16.2.0

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion