Digium Asterisk prior 18.20.1/20.5.1/21.0.1 DTLS improper check or handling of exceptional conditions

Summaryinfo

A vulnerability classified as problematic has been found in Digium Asterisk. Impacted is an unknown function of the component DTLS Handler. Performing a manipulation results in improper check or handling of exceptional conditions. This vulnerability is identified as CVE-2023-49786. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in Digium Asterisk (Communications System). This affects some unknown processing of the component DTLS Handler. The manipulation with an unknown input leads to a improper check or handling of exceptional conditions vulnerability. CWE is classifying the issue as CWE-703. The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product. This is going to have an impact on availability. The summary by CVE is:

Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk prior to versions 18.20.1, 20.5.1, and 21.0.1; as well as certified-asterisk prior to 18.9-cert6; Asterisk is susceptible to a DoS due to a race condition in the hello handshake phase of the DTLS protocol when handling DTLS-SRTP for media setup. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable Asterisk servers for calls that rely on DTLS-SRTP. Commit d7d7764cb07c8a1872804321302ef93bf62cba05 contains a fix, which is part of versions 18.20.1, 20.5.1, 21.0.1, amd 18.9-cert6.

The weakness was released 12/15/2023 as GHSA-hxj9-xwr8-w8pq. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2023-49786 since 11/30/2023. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 214468 (Debian dla-3696 : asterisk - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 18.20.1, 20.5.1 or 21.0.1 eliminates this vulnerability. Applying the patch d7d7764cb07c8a1872804321302ef93bf62cba05 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (214468). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Communications System

Vendor

• Digium

Name

• Asterisk

License

• open-source

Website

• Vendor: https://www.digium.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion