CVE-2019-18790
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in channels/chan_sip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or auto_force_rport.
Se ha descubierto un problema en channels/chan_sip.c en Sangoma Asterisk 13.x antes de 13.29.2, 16.x antes de 16.6.2, y 17.x antes de 17.0.1, y Certified Asterisk 13.21 antes de cert5. Una solicitud SIP puede ser enviada a Asterisk que puede cambiar la dirección IP de un peer SIP. Un REGISTRO no necesita ocurrir, y las llamadas pueden ser secuestradas como resultado. Lo único que se necesita conocer es el nombre del peer; los detalles de autenticación como las contraseñas no necesitan ser conocidos. Esta vulnerabilidad sólo es explotable cuando la opción nat está configurada por defecto, o auto_force_rport
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-11-06 CVE Reserved
- 2019-11-21 CVE Published
- 2024-03-17 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-862: Missing Authorization
CAPEC
References (4)
URL | Tag | Source |
---|---|---|
https://lists.debian.org/debian-lts-announce/2019/11/msg00038.html | Mailing List | |
https://lists.debian.org/debian-lts-announce/2022/04/msg00001.html | Mailing List |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://downloads.asterisk.org/pub/security/AST-2019-006.html | 2022-05-13 |
URL | Date | SRC |
---|---|---|
https://www.asterisk.org/downloads/security-advisories | 2022-05-13 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | >= 13.0.0 < 13.29.2 Search vendor "Digium" for product "Asterisk" and version " >= 13.0.0 < 13.29.2" | - |
Affected
| ||||||
Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | >= 16.0.0 < 16.6.2 Search vendor "Digium" for product "Asterisk" and version " >= 16.0.0 < 16.6.2" | - |
Affected
| ||||||
Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | >= 17.0.0 < 17.0.1 Search vendor "Digium" for product "Asterisk" and version " >= 17.0.0 < 17.0.1" | - |
Affected
| ||||||
Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 13.21.0 Search vendor "Digium" for product "Certified Asterisk" and version "13.21.0" | - |
Affected
| ||||||
Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 13.21.0 Search vendor "Digium" for product "Certified Asterisk" and version "13.21.0" | cert1 |
Affected
| ||||||
Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 13.21.0 Search vendor "Digium" for product "Certified Asterisk" and version "13.21.0" | cert2 |
Affected
| ||||||
Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 13.21.0 Search vendor "Digium" for product "Certified Asterisk" and version "13.21.0" | cert3 |
Affected
| ||||||
Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 13.21.0 Search vendor "Digium" for product "Certified Asterisk" and version "13.21.0" | cert4 |
Affected
| ||||||
Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 13.21.0 Search vendor "Digium" for product "Certified Asterisk" and version "13.21.0" | rc1 |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
|