Asterisk up to 21.4.2 SIP Request return value

Summaryinfo

A vulnerability described as critical has been identified in Asterisk up to 18.9-cert11/18.24.2/20.9.2/20.7-cert1/21.4.2. Impacted is an unknown function of the component SIP Request Handler. The manipulation results in return value. This vulnerability is identified as CVE-2024-42491. The attack can be executed remotely. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Asterisk up to 18.9-cert11/18.24.2/20.9.2/20.7-cert1/21.4.2. It has been classified as critical. Affected is an unknown code block of the component SIP Request Handler. The manipulation with an unknown input leads to a return value vulnerability. CWE is classifying the issue as CWE-252. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. This is going to have an impact on availability. CVE summarizes:

Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 and 20.7-cert2 of certified-asterisk, if Asterisk attempts to send a SIP request to a URI whose host portion starts with `.1` or `[.1]`, and res_resolver_unbound is loaded, Asterisk will crash with a SEGV. To receive a patch, users should upgrade to one of the following versions: 18.24.3, 20.9.3, 21.4.3, certified-18.9-cert12, certified-20.7-cert2. Two workarounds are available. Disable res_resolver_unbound by setting `noload = res_resolver_unbound.so` in modules.conf, or set `rewrite_contact = yes` on all PJSIP endpoints. NOTE: This may not be appropriate for all Asterisk configurations.

The advisory is available at github.com. This vulnerability is traded as CVE-2024-42491 since 08/02/2024. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available.

The vulnerability scanner Nessus provides a plugin with the ID 209341 (Debian dla-3925 : asterisk - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 18.9-cert12, 18.24.3, 20.9.3, 20.7-cert2 or 21.4.3 eliminates this vulnerability. Applying the patch 42a2f4ccfa2c7062a15063e765916b3332e34cc4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at Tenable (209341). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Communications System

Name

• Asterisk

Version

• 18.9-cert11
• 18.24.0
• 18.24.1
• 18.24.2
• 20.7-cert1
• 20.9.0
• 20.9.1
• 20.9.2
• 21.4.0
• 21.4.1
• 21.4.2

License

• open-source

Website

• Product: https://github.com/asterisk/asterisk/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion