CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 0CVE-2021-26717
https://notcve.org/view.php?id=CVE-2021-26717
An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash. Se detectó un problema en Sangoma Asterisk versiones 16.x anteriores a 16.16.1, versiones 17.x anteriores a 17.9.2 y versiones 18.x anteriores a 18.2.1 y Certified Asterisk versiones anteriores a 16.8-cert6. Al renegociar para T.38, si la respuesta remota inicial se retrasó lo suficiente, Asterisk enviaría tanto audio como T.38 en el SDP. • http://packetstormsecurity.com/files/161471/Asterisk-Project-Security-Advisory-AST-2021-002.html http://seclists.org/fulldisclosure/2021/Feb/58 https://downloads.asterisk.org/pub/security https://downloads.asterisk.org/pub/security/AST-2021-002.html https://issues.asterisk.org/jira/browse/ASTERISK-29203 •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2020-35652
https://notcve.org/view.php?id=CVE-2020-35652
An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1.0. A crash can occur when a SIP message is received with a History-Info header that contains a tel-uri, or when a SIP 181 response is received that contains a tel-uri in the Diversion header. Se detectó un problema en el archivo res_pjsip_diversion.c en Sangoma Asterisk versiones anteriores a 13.38.0, versiones 14.x hasta 16.x versiones anteriores a 16.15.0, versiones 17.x anteriores a 17.9.0 y versiones 18.x anteriores a 18.1.0. Puede ocurrir un bloqueo cuando es recibido un mensaje SIP con un encabezado History-Info que contiene un tel-uri, o cuando es recibida una respuesta SIP 181 que contiene un tel-uri en el encabezado Diversion • https://downloads.asterisk.org/pub/security/AST-2020-003.html https://downloads.asterisk.org/pub/security/AST-2020-004.html https://issues.asterisk.org/jira/browse/ASTERISK-29191 https://issues.asterisk.org/jira/browse/ASTERISK-29219 •
CVSS: 9.0EPSS: 72%CPEs: 11EXPL: 0CVE-2019-18610
https://notcve.org/view.php?id=CVE-2019-18610
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands. Se detectó un problema en el archivo manager.c en Sangoma Asterisk versiones hasta 13.x, 16.x, 17.x y Certified Asterisk versiones 13.21 hasta 13.21-cert4. Un usuario de Asterisk Manager Interface (AMI) autenticado remoto sin autorización del sistema podría usar una petición Originate AMI especialmente diseñada para ejecutar comandos arbitrarios del sistema. • http://downloads.asterisk.org/pub/security/AST-2019-007.html https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html https://www.asterisk.org/downloads/security-advisories • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2019-18790
https://notcve.org/view.php?id=CVE-2019-18790
An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport. • http://downloads.asterisk.org/pub/security/AST-2019-006.html https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html https://www.asterisk.org/downloads/security-advisories • CWE-862: Missing Authorization •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-15639
https://notcve.org/view.php?id=CVE-2019-15639
main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario. El archivo main/translate.c en Sangoma Asterisk versiones 13.28.0 y 16.5.0, permite a un atacante remoto enviar un paquete RTP específico durante una llamada y causar un bloqueo en un escenario específico. • http://downloads.asterisk.org/pub/security/AST-2019-005.html http://packetstormsecurity.com/files/154372/Asterisk-Project-Security-Advisory-AST-2019-005.html • CWE-20: Improper Input Validation •