Crash occurs when sending a repeated number of INVITE messages over TCP or TLS transport

vendor:

Asterisk

by:

Alfred Farrugia, Sandro Gauci

6.5

CVSS

MEDIUM

Denial of Service

400

CWE

Product Name: Asterisk

Affected Version From: 15.2.0

Affected Version To: 14.7.5

Patch Exists: YES

Related CWE: CVE-2018-7286

CPE: a:digium:asterisk

Metasploit: https://www.rapid7.com/db/vulnerabilities/debian-cve-2018-7286/, https://www.rapid7.com/db/vulnerabilities/freebsd-cve-2018-7286/

Other Scripts: N/A

Platforms Tested: Windows, Linux, Mac

2018

Crash occurs when sending a repeated number of INVITE messages over TCP or TLS transport

A crash occurs when a number of INVITE messages are sent over TCP or TLS and then the connection is suddenly closed. This issue leads to a segmentation fault.

Mitigation:

Upgrade to the latest version of Asterisk and ensure that `chan_pjsip` is installed with `--with-pjproject-bundled`

Source

Crash occurs when sending a repeated number of INVITE messages over TCP or TLS transport

Mitigation:

Exploit-DB raw data: