SB2022120212 - Multiple vulnerabilities in Asterisk Open Source and Certified Asterisk

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Integer underflow (CVE-ID: CVE-2022-37325)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an integer underflow within the ooh323 module. A remote non-authenticated attacker can initiate a call with a zero length called or calling party number, trigger an integer underflow and crash Asterisk.

2) Improper Privilege Management (CVE-ID: CVE-2022-42706)

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper privilege management. A remote user with “config” permissions can view files outside of Asterisk directory via GetConfig AMI Action even if “live_dangerously" is set to "no".

3) Use-after-free (CVE-ID: CVE-2022-42705)

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within res_pjsip_pubsub.c, res_pjsip_outbound_registration.c, pjsip_transport_events.c files when performing activity on a subscription via a reliable transport at the same time Asterisk is also performing activty on that subscription. A remote user can trigger a use-after-free error and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://downloads.asterisk.org/pub/security/AST-2022-007.html
• https://downloads.asterisk.org/pub/security/AST-2022-009.html
• https://downloads.asterisk.org/pub/security/AST-2022-008.html