2019-07-12 22:15:11 2019-07-31 20:08:51

An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).

Vector

NETWORK

Complexity

MEDIUM

Authentication

SINGLE_INSTANCE

Confidentiality

NONE

Integrity

NONE

Availability

PARTIAL
Digium Asterisk 13.0.0 (not an official CPE) Digium Asterisk 13.0.0 LTS Digium Asterisk 13.0.0 Beta1 (not an official CPE) Digium Asterisk 13.0.0 Beta2 (not an official CPE) Digium Asterisk 13.0.0 Beta3 (not an official CPE) Digium Asterisk 13.0.1 Digium Asterisk 13.0.2 (not an official CPE) Digium Asterisk 13.1.0 Digium Asterisk 13.1.0 release candidate 1 Digium Asterisk 13.1.0 release candidate 2 Digium Asterisk 13.1.1 (not an official CPE) Digium Asterisk 13.2.0 Digium Asterisk 13.2.0 release candidate 1 Digium Asterisk 13.2.1 (not an official CPE) Digium Asterisk 13.3.0 (not an official CPE) Digium Asterisk 13.3.0 Rc1 (not an official CPE) Digium Asterisk 13.3.1 (not an official CPE) Digium Asterisk 13.3.2 (not an official CPE) Digium Asterisk 13.4.0 (not an official CPE) Digium Asterisk 13.4.0 Rc1 (not an official CPE) Digium Asterisk 13.5.0 (not an official CPE) Digium Asterisk 13.5.0 Rc1 (not an official CPE) Digium Asterisk 13.6.0 (not an official CPE) Digium Asterisk 13.6.0 Rc1 (not an official CPE) Digium Asterisk 13.7.0 (not an official CPE) Digium Asterisk 13.7.0 Rc1 (not an official CPE) Digium Asterisk 13.7.0 Rc2 (not an official CPE) Digium Asterisk 13.7.1 (not an official CPE) Digium Asterisk 13.7.2 (not an official CPE) Digium Asterisk 13.8.0 (not an official CPE) Digium Asterisk 13.8.0 Rc1 (not an official CPE) Digium Asterisk 13.8.1 (not an official CPE) Digium Asterisk 13.8.2 (not an official CPE) Digium Asterisk 13.9.0 (not an official CPE) Digium Asterisk 13.9.1 (not an official CPE) Digium Asterisk 13.10.0 (not an official CPE) Digium Asterisk 13.10.0 Rc1 (not an official CPE) Digium Asterisk 13.11.0 (not an official CPE) Digium Asterisk 13.11.1 (not an official CPE) Digium Asterisk 13.11.2 (not an official CPE) Digium Asterisk 13.12 (not an official CPE) Digium Asterisk 13.12.0 (not an official CPE) Digium Asterisk 13.12.1 (not an official CPE) Digium Asterisk 13.12.2 (not an official CPE) Digium Asterisk 13.13 (not an official CPE) Digium Asterisk 13.13.0 (not an official CPE) Digium Asterisk 13.13.1 (not an official CPE) Digium Asterisk 13.14.0 (not an official CPE) Digium Asterisk 13.14.0 Rc1 (not an official CPE) Digium Asterisk 13.14.0 Rc2 (not an official CPE) Digium Asterisk 13.14.1 (not an official CPE) Digium Asterisk 13.15.0 (not an official CPE) Digium Asterisk 13.15.0 Rc1 (not an official CPE) Digium Asterisk 13.15.0 Rc2 (not an official CPE) Digium Asterisk 13.15.0 Rc3 (not an official CPE) Digium Asterisk 13.15.1 (not an official CPE) Digium Asterisk 13.16.0 (not an official CPE) Digium Asterisk 13.16.0 Rc1 (not an official CPE) Digium Asterisk 13.16.0 Rc2 (not an official CPE) Digium Asterisk 13.17.0 (not an official CPE) Digium Asterisk 13.17.0 Rc1 (not an official CPE) Digium Asterisk 13.17.1 (not an official CPE) Digium Asterisk 13.17.2 (not an official CPE) Digium Asterisk 13.18.0 (not an official CPE) Digium Asterisk 13.18.1 (not an official CPE) Digium Asterisk 13.18.2 (not an official CPE) Digium Asterisk 13.18.3 (not an official CPE) Digium Asterisk 13.18.4 (not an official CPE) Digium Asterisk 13.18.5 (not an official CPE) Digium Asterisk 13.19.0 (not an official CPE) Digium Asterisk 13.19.1 (not an official CPE) Digium Asterisk 13.19.2 (not an official CPE) Digium Asterisk 13.20.0 (not an official CPE) Digium Asterisk 13.21.0 (not an official CPE) Digium Asterisk 13.21.1 (not an official CPE) Digium Asterisk 13.22.0 (not an official CPE) Digium Asterisk 13.23.0 (not an official CPE) Digium Asterisk 15.0.0 (not an official CPE) Digium Asterisk 15.0.0 - (not an official CPE) Digium Asterisk 15.0.0 Beta1 (not an official CPE) Digium Asterisk 15.0.0 Rc1 (not an official CPE) Digium Asterisk 15.1.0 (not an official CPE) Digium Asterisk 15.1.1 (not an official CPE) Digium Asterisk 15.1.2 (not an official CPE) Digium Asterisk 15.1.3 (not an official CPE) Digium Asterisk 15.1.4 (not an official CPE) Digium Asterisk 15.1.5 (not an official CPE) Digium Asterisk 15.2.0 (not an official CPE) Digium Asterisk 15.2.0 Rc1 (not an official CPE) Digium Asterisk 15.2.0 Rc2 (not an official CPE) Digium Asterisk 15.2.1 (not an official CPE) Digium Asterisk 15.2.2 (not an official CPE) Digium Asterisk 15.3.0 (not an official CPE) Digium Asterisk 15.3.0 Rc1 (not an official CPE) Digium Asterisk 15.3.0 Rc2 (not an official CPE) Digium Asterisk 15.4.0 (not an official CPE) Digium Asterisk 15.4.0 Rc1 (not an official CPE) Digium Asterisk 15.4.0 Rc2 (not an official CPE) Digium Asterisk 15.4.1 (not an official CPE) Digium Asterisk 15.5.0 (not an official CPE) Digium Asterisk 15.5.0 Rc1 (not an official CPE) Digium Asterisk 15.6.0 (not an official CPE) Digium Asterisk 15.6.0 Rc1 (not an official CPE) Digium Asterisk 15.6.2 (not an official CPE) Digium Asterisk 15.7.0 - (not an official CPE) Digium Asterisk 15.7.0 Rc1 (not an official CPE) Digium Asterisk 15.7.1 (not an official CPE) Digium Asterisk 15.7.2 (not an official CPE) Digium Asterisk 16.0.0 (not an official CPE) Digium Asterisk 16.0.0 Rc1 (not an official CPE) Digium Asterisk 16.0.0 Rc2 (not an official CPE) Digium Asterisk 16.0.0 Rc3 (not an official CPE) Digium Asterisk 16.0.1 (not an official CPE) Digium Asterisk 16.1.0 Rc1 (not an official CPE) Digium Asterisk 16.2.0 - (not an official CPE) Digium Asterisk 16.2.0 Rc1 (not an official CPE) Digium Asterisk 16.2.0 Rc2 (not an official CPE) Digium Asterisk 16.2.1 (not an official CPE) Digium Certified Asterisk 1.8.0.0 Digium Certified Asterisk 1.8.0.0 beta1 Digium Certified Asterisk 1.8.0.0 beta2 Digium Certified Asterisk 1.8.0.0 beta3 Digium Certified Asterisk 1.8.0.0 beta4 Digium Certified Asterisk 1.8.0.0 beta5 Digium Certified Asterisk 1.8.0.0 release candidate 1 Digium Certified Asterisk 1.8.0.0 release candidate 2 Digium Certified Asterisk 1.8.0.0 release candidate 3 Digium Certified Asterisk 1.8.0.0 release candidate 4 Digium Certified Asterisk 1.8.0.0 release candidate 5 Digium Certified Asterisk 1.8.1.0 Digium Certified Asterisk 1.8.1.0 release candidate 1 Digium Certified Asterisk 1.8.2.0 Digium Certified Asterisk 1.8.2.0 release candidate 1 Digium Certified Asterisk 1.8.3.0 Digium Certified Asterisk 1.8.3.0 release candidate 1 Digium Certified Asterisk 1.8.3.0 release candidate 2 Digium Certified Asterisk 1.8.3.0 release candidate 3 Digium Certified Asterisk 1.8.4.0 Digium Certified Asterisk 1.8.4.0 release candidate 1 Digium Certified Asterisk 1.8.4.0 release candidate 2 Digium Certified Asterisk 1.8.4.0 release candidate 3 Digium Certified Asterisk 1.8.5.0 Digium Certified Asterisk 1.8.5.0 release candidate 1 Digium Certified Asterisk 1.8.6.0 Digium Certified Asterisk 1.8.6.0 release candidate 1 Digium Certified Asterisk 1.8.6.0 release candidate 2 Digium Certified Asterisk 1.8.6.0 release candidate 3 Digium Certified Asterisk 1.8.7.0 Digium Certified Asterisk 1.8.7.0 release candidate 1 Digium Certified Asterisk 1.8.7.0 release candidate 2 Digium Certified Asterisk 1.8.8.0 Digium Certified Asterisk 1.8.8.0 release candidate 1 Digium Certified Asterisk 1.8.8.0 release candidate 2 Digium Certified Asterisk 1.8.8.0 release candidate 3 Digium Certified Asterisk 1.8.8.0 release candidate 4 Digium Certified Asterisk 1.8.8.0 release candidate 5 Digium Certified Asterisk 1.8.9.0 Digium Certified Asterisk 1.8.9.0 release candidate 1 Digium Certified Asterisk 1.8.9.0 release candidate 2 Digium Certified Asterisk 1.8.9.0 release candidate 3 Digium Certified Asterisk 1.8.10.0 Digium Certified Asterisk 1.8.10.0 release candidate 1 Digium Certified Asterisk 1.8.10.0 release candidate 2 Digium Certified Asterisk 1.8.10.0 release candidate 3 Digium Certified Asterisk 1.8.10.0 release candidate 4 Asterisk Certified Asterisk 1.8.11-cert Asterisk Certified Asterisk 1.8.11-cert1 Asterisk Certified Asterisk 1.8.11-cert10 Asterisk Certified Asterisk 1.8.11-cert2 Asterisk Certified Asterisk 1.8.11-cert3 Digium Certified asterisk 1.8.11 Cert3-rc1 (not an official CPE) Digium Certified asterisk 1.8.11 Cert3-rc2 (not an official CPE) Asterisk Certified Asterisk 1.8.11-cert4 Asterisk Certified Asterisk 1.8.11-cert5 Digium Certified asterisk 1.8.11 Cert5-rc1 (not an official CPE) Digium Certified asterisk 1.8.11 Cert5-rc2 (not an official CPE) Asterisk Certified Asterisk 1.8.11-cert6 Asterisk Certified Asterisk 1.8.11-cert7 Asterisk Certified Asterisk 1.8.11-cert8 Asterisk Certified Asterisk 1.8.11-cert9 Digium Certified asterisk 1.8.11 Cert9-rc1 (not an official CPE) Digium Certified Asterisk 1.8.11.0 Digium Certified Asterisk 1.8.11.0 release candidate 1 Digium Certified Asterisk 1.8.11.0 release candidate 2 Digium Certified Asterisk 1.8.11.0 release candidate 3 Digium Certified Asterisk 1.8.12.0 Digium Certified Asterisk 1.8.12.0 release candidate 1 Digium Certified Asterisk 1.8.12.0 release candidate 2 Digium Certified Asterisk 1.8.12.0 release candidate 3 Digium Certified Asterisk 1.8.13.0 Digium Certified Asterisk 1.8.13.0 release candidate 1 Digium Certified Asterisk 1.8.13.0 release candidate 2 Digium Certified Asterisk 1.8.14.0 release candidate 1 Digium Certified Asterisk 1.8.14.0 release candidate 2 Digium Certified Asterisk 1.8.15 Digium Certified Asterisk 1.8.15-cert1 Digium Certified asterisk 1.8.15 Cert1-rc1 (not an official CPE) Digium Certified asterisk 1.8.15 Cert1-rc2 (not an official CPE) Digium Certified asterisk 1.8.15 Cert1-rc3 (not an official CPE) Digium Certified Asterisk 1.8.15-cert1 release candidate 1 Digium Certified Asterisk 1.8.15-cert1 release candidate 2 Digium Certified Asterisk 1.8.15-cert1 release candidate 3 Digium Certified Asterisk 1.8.15-cert2 Digium Certified Asterisk 1.8.15-cert3 Digium Certified Asterisk 1.8.15-cert4 Digium Certified Asterisk 1.8.15-cert5 Digium Certified Asterisk 1.8.15-cert6 Digium Certified asterisk 1.8.15 Cert7 (not an official CPE) Digium Certified asterisk 1.8.28 (not an official CPE) Digium Certified Asterisk 1.8.28 cert 1 LTS Digium Certified asterisk 1.8.28 Cert1-rc1 (not an official CPE) Digium Certified asterisk 1.8.28 Cert2 (not an official CPE) Digium Certified Asterisk 1.8.28-cert2 LTS Digium Certified asterisk 1.8.28 Cert3 (not an official CPE) Digium Certified asterisk 1.8.28 Cert4 (not an official CPE) Digium Certified asterisk 1.8.28 Cert5 (not an official CPE) Digium Certified Asterisk 1.8.28.0 LTS Digium Certified asterisk 11.0.0 (not an official CPE) Digium Certified asterisk 11.0.0 Rc1 (not an official CPE) Digium Certified asterisk 11.0.0 Rc2 (not an official CPE) Digium Certified asterisk 11.1.0 (not an official CPE) Digium Certified asterisk 11.1.0 Rc1 (not an official CPE) Digium Certified asterisk 11.1.0 Rc2 (not an official CPE) Digium Certified asterisk 11.1.0 Rc3 (not an official CPE) Digium Certified asterisk 11.2 Cert1 (not an official CPE) Digium Certified asterisk 11.2 Cert1-rc2 (not an official CPE) Digium Certified asterisk 11.2 Cert2 (not an official CPE) Digium Certified asterisk 11.2 Cert3 (not an official CPE) Digium Certified asterisk 11.3.0 (not an official CPE) Digium Certified asterisk 11.3.0 Rc1 (not an official CPE) Digium Certified asterisk 11.3.0 Rc2 (not an official CPE) Digium Certified asterisk 11.4.0 (not an official CPE) Digium Certified asterisk 11.4.0 Rc1 (not an official CPE) Digium Certified asterisk 11.4.0 Rc2 (not an official CPE) Digium Certified asterisk 11.4.0 Rc3 (not an official CPE) Digium Certified asterisk 11.5.0 (not an official CPE) Digium Certified asterisk 11.5.0 Rc1 (not an official CPE) Digium Certified asterisk 11.5.0 Rc2 (not an official CPE) Digium Certified Asterisk 11.6-cert1 Digium Certified Asterisk 11.6 cert 1 LTS Digium Certified asterisk 11.6 Cert1-rc1 (not an official CPE) Digium Certified asterisk 11.6 Cert1-rc2 (not an official CPE) Digium Certified asterisk 11.6 Cert10 (not an official CPE) Digium Certified asterisk 11.6 Cert11 (not an official CPE) Digium Certified asterisk 11.6 Cert12 (not an official CPE) Digium Certified asterisk 11.6 Cert12 ~~lts~~~ (not an official CPE) Digium Certified asterisk 11.6 Cert13 (not an official CPE) Digium Certified asterisk 11.6 Cert13 ~~lts~~~ (not an official CPE) Digium Certified asterisk 11.6 Cert14 (not an official CPE) Digium Certified asterisk 11.6 Cert14 ~~lts~~~ (not an official CPE) Digium Certified asterisk 11.6 Cert14-rc1 (not an official CPE) Digium Certified asterisk 11.6 Cert14-rc2 (not an official CPE) Digium Certified asterisk 11.6 Cert15 (not an official CPE) Digium Certified asterisk 11.6 Cert15 ~~lts~~~ (not an official CPE) Digium Certified asterisk 11.6 Cert16 (not an official CPE) Digium Certified asterisk 11.6 Cert17 (not an official CPE) Digium Certified asterisk 11.6 Cert18 (not an official CPE) Digium Certified Asterisk 11.6-cert1 release candidate 1 Digium Certified Asterisk 11.6-cert1 release candidate 2 Digium Certified Asterisk 11.6-cert2 Digium Certified Asterisk 11.6 cert 2 LTS Digium Certified Asterisk 11.6-cert3 Digium Certified Asterisk 11.6 cert 3 LTS Digium Certified asterisk 11.6 Cert4 (not an official CPE) Digium Certified Asterisk 11.6 cert 4 LTS Digium Certified asterisk 11.6 Cert5 (not an official CPE) Digium Certified Asterisk 11.6 cert 5 LTS Digium Certified asterisk 11.6 Cert6 (not an official CPE) Digium Certified Asterisk 11.6 cert 6 LTS Digium Certified asterisk 11.6 Cert7 (not an official CPE) Digium Certified Asterisk 11.6 cert 7 LTS Digium Certified asterisk 11.6 Cert8 (not an official CPE) Digium Certified Asterisk 11.6 cert8 LTS Digium Certified asterisk 11.6 Cert9 (not an official CPE) Digium Certified Asterisk 11.6.0 LTS Digium Certified Asterisk 11.6.0 Digium Certified Asterisk 11.6.0 release candidate 1 Digium Certified Asterisk 11.6.0 release candidate 2 Digium Certified asterisk 13.1 Cert1 (not an official CPE) Digium Certified asterisk 13.1 Cert1-rc1 (not an official CPE) Digium Certified asterisk 13.1 Cert1-rc3 (not an official CPE) Digium Certified asterisk 13.1 Cert2 (not an official CPE) Digium Certified asterisk 13.1 Cert3 (not an official CPE) Digium Certified asterisk 13.1 Cert3-rc1 (not an official CPE) Digium Certified asterisk 13.1 Cert4 (not an official CPE) Digium Certified asterisk 13.1 Cert5 (not an official CPE) Digium Certified asterisk 13.1 Cert6 (not an official CPE) Digium Certified asterisk 13.1 Cert7 (not an official CPE) Digium Certified asterisk 13.1 Cert8 (not an official CPE) Digium Certified asterisk 13.1.0 (not an official CPE) Digium Certified asterisk 13.1.0 Rc1 (not an official CPE) Digium Certified asterisk 13.1.0 Rc2 (not an official CPE) Digium Certified asterisk 13.8 Cert1 (not an official CPE) Digium Certified asterisk 13.8 Cert1-rc2 (not an official CPE) Digium Certified asterisk 13.8 Cert1-rc3 (not an official CPE) Digium Certified asterisk 13.8 Cert1 rc1 (not an official CPE) Digium Certified asterisk 13.8 Cert1 rc2 (not an official CPE) Digium Certified asterisk 13.8 Cert1 rc3 (not an official CPE) Digium Certified asterisk 13.8 Cert2 (not an official CPE) Digium Certified asterisk 13.8 Cert2-rc1 (not an official CPE) Digium Certified asterisk 13.8 Cert2 rc1 (not an official CPE) Digium Certified asterisk 13.8 Cert3 (not an official CPE) Digium Certified asterisk 13.8 Cert4 (not an official CPE) Digium Certified asterisk 13.8.0 (not an official CPE) Digium Certified asterisk 13.8.0 Rc1 (not an official CPE) Digium Certified asterisk 13.13 Cert1-rc1 (not an official CPE) Digium Certified asterisk 13.13 Cert1-rc2 (not an official CPE) Digium Certified asterisk 13.13 Cert1-rc3 (not an official CPE) Digium Certified asterisk 13.13 Cert1-rc4 (not an official CPE) Digium Certified asterisk 13.13 Cert2 (not an official CPE) Digium Certified asterisk 13.13 Cert3 (not an official CPE) Digium Certified asterisk 13.13 Cert4 (not an official CPE) Digium Certified asterisk 13.13 Cert5 (not an official CPE) Digium Certified asterisk 13.13 Cert6 (not an official CPE) Digium Certified asterisk 13.13 Cert7 (not an official CPE) Digium Certified asterisk 13.13 Cert8 (not an official CPE) Digium Certified asterisk 13.13 Cert9 (not an official CPE) Digium Certified asterisk 13.13-cert2 (not an official CPE) Digium Certified asterisk 13.18 Cert1 (not an official CPE) Digium Certified asterisk 13.18 Cert1-rc1 (not an official CPE) Digium Certified asterisk 13.18 Cert1-rc2 (not an official CPE) Digium Certified asterisk 13.18 Cert1-rc3 (not an official CPE) Digium Certified asterisk 13.18 Cert2 (not an official CPE) Digium Certified asterisk 13.18 Cert3 (not an official CPE) Digium Certified asterisk 13.18 Cert4 (not an official CPE) Digium Certified asterisk 13.21 Cert1 (not an official CPE) Digium Certified asterisk 13.21 Cert1-rc1 (not an official CPE) Digium Certified asterisk 13.21 Cert1-rc2 (not an official CPE) Digium Certified asterisk 13.21 Cert2 (not an official CPE) Digium Certified asterisk 13.21 Cert3 (not an official CPE)