CVEvulnerability

CVE-2019-13161

5.3 MEDIUM Published 2019-07-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-07-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:N/A:P
Weaknesses
CWE-476

Description

An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38 re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL stream and another media stream containing only a codec (which is not permitted according to the chan_sip configuration).

Affected configurations

• digium certified asterisk 1.8.0.0 • digium certified asterisk 1.8.1.0 • digium certified asterisk 1.8.2.0 • digium certified asterisk 1.8.3.0 • digium certified asterisk 1.8.4.0 • digium certified asterisk 1.8.5.0 • digium certified asterisk 1.8.6.0 • digium certified asterisk 1.8.7.0 • digium certified asterisk 1.8.8.0 • digium certified asterisk 1.8.9.0 • digium certified asterisk 1.8.10.0 • digium certified asterisk 1.8.11 • digium certified asterisk 1.8.11.0 • digium certified asterisk 1.8.12.0 • digium certified asterisk 1.8.13.0 • digium certified asterisk 1.8.14.0 • digium certified asterisk 1.8.15 • digium certified asterisk 1.8.28 • digium certified asterisk 1.8.28.0 • digium certified asterisk 11.0.0 • digium certified asterisk 11.1.0 • digium certified asterisk 11.2 • digium certified asterisk 11.3.0 • digium certified asterisk 11.4.0 • digium certified asterisk 11.5.0 • digium certified asterisk 11.6 • digium certified asterisk 11.6.0 • digium certified asterisk 13.1 • digium certified asterisk 13.1.0 • digium certified asterisk 13.8 • digium certified asterisk 13.8.0 • digium certified asterisk 13.13 • digium certified asterisk 13.13-cert2 • digium certified asterisk 13.18 • digium certified asterisk 13.21 • digium asterisk (>= 13.0.0 < 13.27.1) • digium asterisk (>= 15.0.0 < 15.7.3) • digium asterisk (>= 16.0.0 < 16.4.1) • debian debian linux 8.0 • debian debian linux 9.0

Related

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References