Asterisk Project Security Advisory – AST-2021-004 ≈ Packet Storm – Digitalmunition




Exploit/Advisories no-image-featured-image.png

Published on February 19th, 2021 📆 | 5363 Views ⚑

0

Asterisk Project Security Advisory – AST-2021-004 ≈ Packet Storm

Asterisk Project Security Advisory – AST-2021-004

Product Asterisk
Summary An unsuspecting user could crash Asterisk with
multiple hold/unhold requests
Nature of Advisory Denial of Service
Susceptibility Remote authenticated sessions
Severity Moderate
Exploits Known No
Reported On December 9, 2020
Reported By Edvin Vidmar
Posted On
Last Updated On February 11, 2021
Advisory Contact gjoseph AT sangoma DOT com
CVE Name CVE-2021-26714

Description Due to a signedness comparison mismatch, an
authenticated WebRTC client could cause a stack
overflow and Asterisk crash by sending multiple
hold/unhold requests in quick succession.
Modules Affected res_rtp_asterisk.c

Resolution The packet size comparison terms have been corrected.

Affected Versions
Product Release Series
Asterisk Open Source 16.x 16.16.0
Asterisk Open Source 17.x 17.9.1
Asterisk Open Source 18.x 18.2.0
Certified Asterisk 16.x 16.8-cert5

Corrected In
Product Release
Asterisk Open Source 16.16.1, 17.9.2, 18.2.1
Certified Asterisk 16.8-cert6

Patches
Patch URL Revision
https:/downloads.asterisk.org/pub/security/AST-2021-004-16.diff Asterisk
16
https:/downloads.asterisk.org/pub/security/AST-2021-004-17.diff Asterisk
17
https:/downloads.asterisk.org/pub/security/AST-2021-004-18.diff Asterisk
18
https:/downloads.asterisk.org/pub/security/AST-2021-004-16.8.diff Certified
Asterisk
16.8-cert6

Links https://issues.asterisk.org/jira/browse/ASTERISK-29205

https://downloads.asterisk.org/pub/security/AST-2021-004.html

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
https://downloads.digium.com/pub/security/AST-2021-004.pdf and
https://downloads.digium.com/pub/security/AST-2021-004.html

Revision History
Date Editor Revisions Made
February 4, 2021 George Joseph Initial revision
February 9, 2021 George Joseph Added CVE

Asterisk Project Security Advisory – AST-2021-004
Copyright © 2021 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.

Source link

Tagged with:



Leave a Reply