SB2017090101 - Multiple vulnerability in Digium Asterisk

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Session hijacking (CVE-ID: CVE-2017-14099)

The vulnerability allows a remote attacker to hijack the target user's media session.

The weakness exists due to a flaw in the strict RTP support feature. A remote attacker can send specially crafted RTP traffic to provide and receive media from the session.

2) Command injection (CVE-ID: CVE-2017-14100)

The vulnerability allows a remote authenticated attacker to execute arbitrary commands on the target system.

The weakness exists due to input validation flaw in the 'app_minivm' module. A remote attacker can send supply specially crafted caller-id name and number data and execute arbitrary operating system commands.

Successful exploitation of the vulnerability may result in system compromise.

3) Improper input validation (CVE-ID: CVE-2017-14098)

The vulnerability allows a remote attacker can cause DoS condition on the target system.

The weakness exists due to a flaw in 'pjsip_message_ip_updater'. A remote attacker can submit a specially crafted URI in a 'From', 'To', and 'Contact' header and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Remediation

Install update from vendor's website.

References

• http://downloads.asterisk.org/pub/security/AST-2017-005.html
• http://downloads.asterisk.org/pub/security/AST-2017-006.html
• http://downloads.asterisk.org/pub/security/AST-2017-007.html