CVE-2019-13161

Name
CVE-2019-13161
Description
An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Vendor Advisory http://downloads.digium.com/pub/security/AST-2019-003.html
Issue Tracking https://issues.asterisk.org/jira/browse/ASTERISK-28465
MLIST https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:digium:certified_asterisk:1.8.0.0:beta5:*:*:*:*:*:* certified_asterisk == None == 1.8.0.0
cpe:2.3:a:digium:certified_asterisk:1.8.4.0:rc3:*:*:*:*:*:* certified_asterisk == None == 1.8.4.0
cpe:2.3:a:digium:certified_asterisk:1.8.5.0:-:*:*:*:*:*:* certified_asterisk == None == 1.8.5.0
cpe:2.3:a:digium:certified_asterisk:1.8.6.0:-:*:*:*:*:*:* certified_asterisk == None == 1.8.6.0
cpe:2.3:a:digium:certified_asterisk:1.8.9.0:rc1:*:*:*:*:*:* certified_asterisk == None == 1.8.9.0
cpe:2.3:a:digium:certified_asterisk:1.8.10.0:-:*:*:*:*:*:* certified_asterisk == None == 1.8.10.0
cpe:2.3:a:digium:certified_asterisk:1.8.13.0:rc2:*:*:*:*:*:* certified_asterisk == None == 1.8.13.0
cpe:2.3:a:digium:certified_asterisk:1.8.28:cert1-rc1:*:*:*:*:*:* certified_asterisk == None == 1.8.28
cpe:2.3:a:digium:certified_asterisk:11.6.0:*:*:*:lts:*:*:* certified_asterisk == None == 11.6.0
cpe:2.3:a:digium:certified_asterisk:11.6:cert2:*:*:lts:*:*:* certified_asterisk == None == 11.6
cpe:2.3:a:digium:certified_asterisk:13.13:cert2:*:*:*:*:*:* certified_asterisk == None == 13.13
cpe:2.3:a:digium:certified_asterisk:11.2:cert3:*:*:*:*:*:* certified_asterisk == None == 11.2
cpe:2.3:a:digium:certified_asterisk:13.21:cert1-rc2:*:*:*:*:*:* certified_asterisk == None == 13.21
cpe:2.3:a:digium:certified_asterisk:13.18:cert3:*:*:*:*:*:* certified_asterisk == None == 13.18
cpe:2.3:a:digium:certified_asterisk:1.8.15:cert7:*:*:*:*:*:* certified_asterisk == None == 1.8.15
cpe:2.3:a:digium:certified_asterisk:1.8.14.0:rc2:*:*:*:*:*:* certified_asterisk == None == 1.8.14.0
cpe:2.3:a:digium:certified_asterisk:1.8.11:cert7:*:*:*:*:*:* certified_asterisk == None == 1.8.11
cpe:2.3:a:digium:certified_asterisk:13.1.0:rc2:*:*:*:*:*:* certified_asterisk == None == 13.1.0
cpe:2.3:a:digium:certified_asterisk:13.8:cert1:*:*:*:*:*:* certified_asterisk == None == 13.8
cpe:2.3:a:digium:certified_asterisk:1.8.2.0:rc1:*:*:*:*:*:* certified_asterisk == None == 1.8.2.0
cpe:2.3:a:digium:certified_asterisk:11.1.0:rc1:*:*:*:*:*:* certified_asterisk == None == 11.1.0
cpe:2.3:a:digium:certified_asterisk:1.8.1.0:rc1:*:*:*:*:*:* certified_asterisk == None == 1.8.1.0
cpe:2.3:a:digium:certified_asterisk:1.8.7.0:rc1:*:*:*:*:*:* certified_asterisk == None == 1.8.7.0
cpe:2.3:a:digium:certified_asterisk:1.8.8.0:rc3:*:*:*:*:*:* certified_asterisk == None == 1.8.8.0
cpe:2.3:a:digium:certified_asterisk:13.1:cert1:*:*:*:*:*:* certified_asterisk == None == 13.1
cpe:2.3:a:digium:certified_asterisk:1.8.12.0:rc2:*:*:*:*:*:* certified_asterisk == None == 1.8.12.0
cpe:2.3:a:digium:certified_asterisk:13.8.0:*:*:*:*:*:*:* certified_asterisk == None == 13.8.0
cpe:2.3:a:digium:certified_asterisk:1.8.3.0:-:*:*:*:*:*:* certified_asterisk == None == 1.8.3.0
cpe:2.3:a:digium:certified_asterisk:11.3.0:*:*:*:*:*:*:* certified_asterisk == None == 11.3.0
cpe:2.3:a:digium:certified_asterisk:1.8.11.0:rc3:*:*:*:*:*:* certified_asterisk == None == 1.8.11.0
cpe:2.3:a:digium:certified_asterisk:11.5.0:rc2:*:*:*:*:*:* certified_asterisk == None == 11.5.0
cpe:2.3:a:digium:certified_asterisk:1.8.28.0:*:*:*:lts:*:*:* certified_asterisk == None == 1.8.28.0
cpe:2.3:a:digium:certified_asterisk:11.4.0:rc1:*:*:*:*:*:* certified_asterisk == None == 11.4.0
cpe:2.3:a:digium:certified_asterisk:11.0.0:*:*:*:*:*:*:* certified_asterisk == None == 11.0.0
cpe:2.3:a:digium:certified_asterisk:13.13-cert2:*:*:*:*:*:*:* certified_asterisk == None == 13.13-cert2

Vulnerable and fixed packages

Source package Branch Version Maintainer Status