Digium Asterisk up to 11.23.0/13.11.0 RTP resource consumption

Summaryinfo

A vulnerability was found in Digium Asterisk up to 11.23.0/13.11.0. It has been classified as problematic. Affected by this issue is some unknown functionality of the component RTP Handler. Performing a manipulation results in resource consumption. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability classified as problematic has been found in Digium Asterisk up to 11.23.0/13.11.0 (Communications System). This affects an unknown code block of the component RTP Handler. The manipulation with an unknown input leads to a resource consumption vulnerability. CWE is classifying the issue as CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. This is going to have an impact on availability.

The weakness was published 10/25/2016 by Walter Doekes with Asterisk as AST-2016-007: UPDATE as confirmed mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The public release has been coordinated with Digium. It is possible to initiate the attack remotely. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 81 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 11.23.1 or 13.11.1 eliminates this vulnerability.

Similar entry is available at VDB-99926. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Communications System

Vendor

• Digium

Name

• Asterisk

Version

• 11.0
• 11.1
• 11.2
• 11.3
• 11.4
• 11.5
• 11.6
• 11.7
• 11.8
• 11.9
• 11.10
• 11.11
• 11.12
• 11.13
• 11.14
• 11.15
• 11.16
• 11.17
• 11.18
• 11.19
• 11.20
• 11.21
• 11.22
• 11.23.0
• 13.0
• 13.1
• 13.2
• 13.3
• 13.4
• 13.5
• 13.6
• 13.7
• 13.8
• 13.9
• 13.10
• 13.11.0

License

• open-source

Website

• Vendor: https://www.digium.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion