CVSS: 5.9EPSS: 0%CPEs: 17EXPL: 0CVE-2021-26906
https://notcve.org/view.php?id=CVE-2021-26906
An issue was discovered in res_pjsip_session.c in Digium Asterisk through 13.38.1; 14.x, 15.x, and 16.x through 16.16.0; 17.x through 17.9.1; and 18.x through 18.2.0, and Certified Asterisk through 16.8-cert5. An SDP negotiation vulnerability in PJSIP allows a remote server to potentially crash Asterisk by sending specific SIP responses that cause an SDP negotiation failure. Se detectó un problema en el archivo res_pjsip_session.c en Digium Asterisk versiones hasta 13.38.1; 14.x, 15.x y 16.xa 16.16.0; 17.xa 17.9.1; y 18.xa 18.2.0, y Certified Asterisk versiones hasta 16.8-cert5. Una vulnerabilidad de negociación SDP en PJSIP permite a un servidor remoto bloquear potencialmente Asterisk mediante el envío de respuestas SIP específicas que causan un fallo en la negociación SDP • http://packetstormsecurity.com/files/161477/Asterisk-Project-Security-Advisory-AST-2021-005.html http://seclists.org/fulldisclosure/2021/Feb/61 https://downloads.asterisk.org/pub/security https://downloads.asterisk.org/pub/security/AST-2021-005.html https://issues.asterisk.org/jira/browse/ASTERISK-29196 • CWE-404: Improper Resource Shutdown or Release •
CVSS: 7.5EPSS: 0%CPEs: 16EXPL: 0CVE-2021-26717
https://notcve.org/view.php?id=CVE-2021-26717
An issue was discovered in Sangoma Asterisk 16.x before 16.16.1, 17.x before 17.9.2, and 18.x before 18.2.1 and Certified Asterisk before 16.8-cert6. When re-negotiating for T.38, if the initial remote response was delayed just enough, Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream, then Asterisk would crash. Se detectó un problema en Sangoma Asterisk versiones 16.x anteriores a 16.16.1, versiones 17.x anteriores a 17.9.2 y versiones 18.x anteriores a 18.2.1 y Certified Asterisk versiones anteriores a 16.8-cert6. Al renegociar para T.38, si la respuesta remota inicial se retrasó lo suficiente, Asterisk enviaría tanto audio como T.38 en el SDP. • http://packetstormsecurity.com/files/161471/Asterisk-Project-Security-Advisory-AST-2021-002.html http://seclists.org/fulldisclosure/2021/Feb/58 https://downloads.asterisk.org/pub/security https://downloads.asterisk.org/pub/security/AST-2021-002.html https://issues.asterisk.org/jira/browse/ASTERISK-29203 •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2020-35652
https://notcve.org/view.php?id=CVE-2020-35652
An issue was discovered in res_pjsip_diversion.c in Sangoma Asterisk before 13.38.0, 14.x through 16.x before 16.15.0, 17.x before 17.9.0, and 18.x before 18.1.0. A crash can occur when a SIP message is received with a History-Info header that contains a tel-uri, or when a SIP 181 response is received that contains a tel-uri in the Diversion header. Se detectó un problema en el archivo res_pjsip_diversion.c en Sangoma Asterisk versiones anteriores a 13.38.0, versiones 14.x hasta 16.x versiones anteriores a 16.15.0, versiones 17.x anteriores a 17.9.0 y versiones 18.x anteriores a 18.1.0. Puede ocurrir un bloqueo cuando es recibido un mensaje SIP con un encabezado History-Info que contiene un tel-uri, o cuando es recibida una respuesta SIP 181 que contiene un tel-uri en el encabezado Diversion • https://downloads.asterisk.org/pub/security/AST-2020-003.html https://downloads.asterisk.org/pub/security/AST-2020-004.html https://issues.asterisk.org/jira/browse/ASTERISK-29191 https://issues.asterisk.org/jira/browse/ASTERISK-29219 •
CVSS: 9.0EPSS: 69%CPEs: 11EXPL: 0CVE-2019-18610
https://notcve.org/view.php?id=CVE-2019-18610
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands. Se detectó un problema en el archivo manager.c en Sangoma Asterisk versiones hasta 13.x, 16.x, 17.x y Certified Asterisk versiones 13.21 hasta 13.21-cert4. Un usuario de Asterisk Manager Interface (AMI) autenticado remoto sin autorización del sistema podría usar una petición Originate AMI especialmente diseñada para ejecutar comandos arbitrarios del sistema. • http://downloads.asterisk.org/pub/security/AST-2019-007.html https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html https://www.asterisk.org/downloads/security-advisories • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 11EXPL: 0CVE-2019-18790
https://notcve.org/view.php?id=CVE-2019-18790
An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport. • http://downloads.asterisk.org/pub/security/AST-2019-006.html https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html https://www.asterisk.org/downloads/security-advisories • CWE-862: Missing Authorization •