Asterisk vulnerabilities

An issue was discovered in Asterisk versions 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older that causes a crash when processing certain SIP messages without a contact header. This issue occurs only when the PJSIP channel driver is used.

In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2, insufficient RTCP packet validation could allow reading stale buffer contents. When combined with the 'nat' and 'symmetric_rtp' options, this could allow redirecting where Asterisk sends the next RTCP report.

ast_loggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs ast_loggrabber with elevated privileges.

app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The SMS dialplan application must be explicitly used and input not validated.

An out-of-bounds write in the Codec2 decoder caused by a floor/ceil sample-count mismatch leads to a heap buffer overflow. An authenticated attacker can exploit it by sending crafted Codec2 audio packets within an established call.

An unbounded sscanf in res_pjsip_pubsub when parsing the MWI NOTIFY Message-Account field may allow an unauthenticated attacker to send a crafted packet causing a stack buffer overflow and corrupting the transport, permanently disabling all SIP functionality until restart.

The PostgreSQL and TDS/MSSQL Channel Event Log backends cel_pgsql and cel_tds may permit arbitrary SQL execution when untrusted data is set in the CEL eventtype column by the CELGenUserEvent dialplan application. The backend must be loaded and configured, and CELGenUserEvent must be called without validating input.

The chan_ooh323 Q.931 party-number parser lacks the CVE-2022-37325 fix, which was never forward-ported from Asterisk 20 to later versions. Malformed Q.931 elements in an OOH323 request can crash Asterisk.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only ARI permissions may, under certain conditions, perform write operations via REST-over-WebSocket. The authorization bypass enables arbitrary module path loading and conditional remote code execution.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a NULL pointer dereference in the Asterisk Manager Interface (AMI) may allow an unauthenticated attacker to crash Asterisk when Digest Authentication is used via HTTP.

Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use setChannelVar to execute write dialplan functions, including FILE() writes, even when live_dangerously in asterisk.conf is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid read-only ARI credentials; HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled.

Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a stack buffer overflow in res_xmpp XMPP namespace prefix handling using carefully crafted packets. The res_xmpp module must be loaded, an XMPP connection must be configured in xmpp.conf, and the attacker must have an XMPP account on the same or a federated server.

Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3 contains a stack buffer overflow in the H.323 ooTrace() trace-logging function. An unbounded vsprintf writes into a fixed 2048-byte buffer, which can crash the Asterisk process when a crafted packet is sent.

In Asterisk, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured with its `textsupport` option enabled (defaults to no). Patches are contained in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11 and 22.8-cert3.

Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3 contains an unbounded memcpy of OGG/Speex packet data in format_ogg_speex. This can cause a heap buffer overflow and crash Asterisk when reading a file containing corrupted Speex audio.

An out-of-bounds write in the chan_unistim module's DIALPAGE digit handling can overflow the phone_number field and crash Asterisk when a crafted incoming request packet is sent. The chan_unistim module must be loaded and configured with a reachable UNISTIM UDP port, and the attacker must register as a configured phone MAC or use an equivalent autoprovisioning path. The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

In Asterisk, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during generation accumulation using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The `chan_sip` channel driver must be installed and configured with its `textsupport` option enabled (defaults to no). Patches are contained in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11 and 22.8-cert3.

An authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a crafted SIP NOTIFY request. The attacker must pass SIP authentication using a username/password or source IP address matching. The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages to retrieve an authorized user's AMI session cookie and impersonate that user when res_phoneprov is enabled. The Asterisk HTTP server, AMI, and AMI access via HTTP must all be enabled (disabled by default), and the attacker must convince the user to click a malicious link.

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver res_config_ldap may permit LDAP filter injection through a SIP username, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The res_config_ldap module must be loaded and configured to access an LDAP server, which is not the default.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a connection-oriented transport and disconnecting before Asterisk responds with 200 OK. The crash has so far only been reproduced when Asterisk is built with Address Sanitizer, which is not used in production systems.

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the chan_ooh323 Q.931 information-element parser permits an out-of-bounds read that may allow an unauthenticated attacker to crash Asterisk using carefully crafted setup packets. The chan_ooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable.

The safe_asterisk script included with the Asterisk toolkit sources all .sh files in /etc/asterisk/startup.d/ as root without validating ownership or permissions. Non-root users with legitimate write access to /etc/asterisk can place malicious scripts in startup.d that execute with root privileges upon service restart.

In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.