CVE-2016-2316: Integer Underflow

Published Feb 22, 2016
·
Updated

chansip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values.

Affected Software

291 affected componentsFixes available
debian/asterisk
1:16.28.0~dfsg-0+deb11u41:20.8.1~dfsg+~cs6.14.40431414-1
fedoraproject fedora=22
fedoraproject fedora=23
Asterisk=1.8.0
Asterisk=1.8.0-beta1
Asterisk=1.8.0-beta2
Asterisk=1.8.0-beta3
Asterisk=1.8.0-beta4
Asterisk=1.8.0-beta5
Asterisk=1.8.0-rc2
Asterisk=1.8.0-rc3
Asterisk=1.8.0-rc4
Asterisk=1.8.0-rc5
Asterisk=1.8.1
Asterisk=1.8.1-rc1
Asterisk=1.8.1.1
Asterisk=1.8.1.2
Asterisk=1.8.2
Asterisk=1.8.2.1
Asterisk=1.8.2.2
Asterisk=1.8.2.3
Asterisk=1.8.2.4
Asterisk=1.8.3
Asterisk=1.8.3-rc1
Asterisk=1.8.3-rc2
Asterisk=1.8.3-rc3
Asterisk=1.8.3.1
Asterisk=1.8.3.2
Asterisk=1.8.3.3
Asterisk=1.8.4
Asterisk=1.8.4-rc1
Asterisk=1.8.4-rc2
Asterisk=1.8.4-rc3
Asterisk=1.8.4.1
Asterisk=1.8.4.2
Asterisk=1.8.4.3
Asterisk=1.8.4.4
Asterisk=1.8.5
Asterisk=1.8.5-rc1
Asterisk=1.8.5.0
Asterisk=1.8.6.0
Asterisk=1.8.6.0-rc1
Asterisk=1.8.6.0-rc2
Asterisk=1.8.6.0-rc3
Asterisk=1.8.7.0
Asterisk=1.8.7.0-rc1
Asterisk=1.8.7.0-rc2
Asterisk=1.8.7.1
Asterisk=1.8.8.0
Asterisk=1.8.8.0
Asterisk=1.8.8.0-patch
Asterisk=1.8.8.0-rc1
Asterisk=1.8.8.0-rc2
Asterisk=1.8.8.0-rc3
Asterisk=1.8.8.0-rc4
Asterisk=1.8.8.0-rc5
Asterisk=1.8.8.1
Asterisk=1.8.8.2
Asterisk=1.8.9.0
Asterisk=1.8.9.0
Asterisk=1.8.9.0-rc1
Asterisk=1.8.9.0-rc2
Asterisk=1.8.9.0-rc3
Asterisk=1.8.9.1
Asterisk=1.8.9.2
Asterisk=1.8.9.3
Asterisk=1.8.10.0
Asterisk=1.8.10.0
Asterisk=1.8.10.0-rc1
Asterisk=1.8.10.0-rc2
Asterisk=1.8.10.0-rc3
Asterisk=1.8.10.0-rc4
Asterisk=1.8.10.1
Asterisk=1.8.11.0
Asterisk=1.8.11.0
Asterisk=1.8.11.0-patch
Asterisk=1.8.11.0-rc2
Asterisk=1.8.11.0-rc3
Asterisk=1.8.11.1
Asterisk=1.8.11.1
Asterisk=1.8.11.1-patch
Asterisk=1.8.12
Asterisk=1.8.12.0
Asterisk=1.8.12.0
Asterisk=1.8.12.0-rc1
Asterisk=1.8.12.0-rc2
Asterisk=1.8.12.0-rc3
Asterisk=1.8.12.1
Asterisk=1.8.12.2
Asterisk=1.8.13.0
Asterisk=1.8.13.0-rc1
Asterisk=1.8.13.0-rc2
Asterisk=1.8.13.1
Asterisk=1.8.14.0
Asterisk=1.8.14.0-patch
Asterisk=1.8.14.0-rc1
Asterisk=1.8.14.0-rc2
Asterisk=1.8.14.1
Asterisk=1.8.14.1
Asterisk=1.8.14.1-patch
Asterisk=1.8.15.0
Asterisk=1.8.15.0
Asterisk=1.8.15.0-rc1
Asterisk=1.8.15.1
Asterisk=1.8.16.0
Asterisk=1.8.16.0
Asterisk=1.8.16.0-rc1
Asterisk=1.8.16.0-rc2
Asterisk=1.8.17.0
Asterisk=1.8.17.0
Asterisk=1.8.17.0-patch
Asterisk=1.8.17.0-rc1
Asterisk=1.8.17.0-rc2
Asterisk=1.8.17.0-rc3
Asterisk=1.8.18.0
Asterisk=1.8.18.0
Asterisk=1.8.18.0-rc1
Asterisk=1.8.18.1
Asterisk=1.8.19.0
Asterisk=1.8.19.0
Asterisk=1.8.19.0-rc1
Asterisk=1.8.19.0-rc3
Asterisk=1.8.19.1
Asterisk=1.8.20.0
Asterisk=1.8.20.0-patch
Asterisk=1.8.20.0-rc1
Asterisk=1.8.20.0-rc2
Asterisk=1.8.20.1
Asterisk=1.8.20.1-patch
Asterisk=1.8.20.2
Asterisk=1.8.20.2-patch
Asterisk=1.8.21.0
Asterisk=1.8.21.0-rc1
Asterisk=1.8.21.0-rc2
Asterisk=1.8.22.0
Asterisk=1.8.22.0-rc1
Asterisk=1.8.22.0-rc2
Asterisk=1.8.23.0
Asterisk=1.8.23.0-patch
Asterisk=1.8.23.0-rc1
Asterisk=1.8.23.0-rc2
Asterisk=1.8.23.1
Asterisk=1.8.24.0
Asterisk=1.8.24.0-rc1
Asterisk=1.8.24.0-rc2
Asterisk=1.8.24.1
Asterisk=1.8.25.0
Asterisk=1.8.25.0-rc1
Asterisk=1.8.25.0-rc2
Asterisk=1.8.26.0
Asterisk=1.8.26.0-rc1
Asterisk=1.8.26.1
Asterisk=1.8.27.0
Asterisk=1.8.27.0-rc1
Asterisk=1.8.27.0-rc2
Asterisk=1.8.28.0
Asterisk=1.8.28.0-rc1
Asterisk=1.8.28.1
Asterisk=1.8.28.2
Asterisk=1.8.32.0
Asterisk=11.0.0
Asterisk=11.0.0-beta1
Asterisk=11.0.0-beta2
Asterisk=11.0.0-rc1
Asterisk=11.0.0-rc2
Asterisk=11.0.1
Asterisk=11.0.2
Asterisk=11.1.0
Asterisk=11.1.0-rc1
Asterisk=11.1.0-rc2
Asterisk=11.1.0-rc3
Asterisk=11.1.1
Asterisk=11.1.2
Asterisk=11.2.0-rc1
Asterisk=11.4.0-rc4
Asterisk=11.6.0
Asterisk=11.6.0-rc1
Asterisk=11.6.0-rc2
Asterisk=11.7.0
Asterisk=11.7.0-rc1
Asterisk=11.7.0-rc2
Asterisk=11.8.0
Asterisk=11.8.0-rc1
Asterisk=11.8.0-rc2
Asterisk=11.8.0-rc3
Asterisk=11.8.1
Asterisk=11.9.0
Asterisk=11.9.0-rc1
Asterisk=11.9.0-rc2
Asterisk=11.9.0-rc3
Asterisk=11.10.0
Asterisk=11.10.0-rc1
Asterisk=11.10.1
Asterisk=11.10.1-rc1
Asterisk=11.11.0
Asterisk=11.11.0-rc1
Asterisk=11.12.0
Asterisk=11.12.0-rc1
Asterisk=11.13.0
Asterisk=11.13.0-rc1
Asterisk=11.14.0
Asterisk=11.14.0-rc1
Asterisk=11.14.0-rc2
Asterisk=11.15.0
Asterisk=11.15.0-rc1
Asterisk=11.15.0-rc2
Asterisk=11.16.0
Asterisk=11.16.0-rc1
Asterisk=11.17.0-rc1
Asterisk=11.18.0
Asterisk=11.18.0-rc1
Asterisk=11.19.0-rc1
Asterisk=11.20.0-rc1
Asterisk=11.21.0
Asterisk=11.21.0-rc1
Asterisk=11.21.0-rc2
Asterisk=11.21.0-rc3
Asterisk=12.0.0
Asterisk=12.1.0
Asterisk=12.1.0-rc1
Asterisk=12.1.0-rc2
Asterisk=12.1.0-rc3
Asterisk=12.1.1
Asterisk=12.2.0
Asterisk=12.2.0-rc1
Asterisk=12.2.0-rc2
Asterisk=12.2.0-rc3
Asterisk=12.3.0
Asterisk=12.3.0-rc1
Asterisk=12.3.0-rc2
Asterisk=12.3.1
Asterisk=12.3.2
Asterisk=12.4.0
Asterisk=12.4.0-rc1
Asterisk=12.5.0
Asterisk=12.5.0-rc1
Asterisk=12.6.0
Asterisk=12.6.0-rc1
Asterisk=12.7.0
Asterisk=12.7.0
Asterisk=12.7.0-rc1
Asterisk=12.7.0-rc2
Asterisk=12.7.1
Asterisk=12.8.0
Asterisk=12.8.0-rc1
Asterisk=12.8.0-rc2
Asterisk=12.8.1
Asterisk=12.8.2
Asterisk=13.0.0
Asterisk=13.0.1
Asterisk=13.1.0
Asterisk=13.1.0-rc1
Asterisk=13.1.0-rc2
Asterisk=13.2.0
Asterisk=13.2.0-rc1
Asterisk=13.3.0-rc1
Asterisk=13.4.0
Asterisk=13.4.0-rc1
Asterisk=13.5.0
Asterisk=13.5.0-rc1
Asterisk=13.6.0-rc1
Asterisk=13.7.0
Asterisk=13.7.0-rc1
Asterisk=13.7.0-rc2
Asterisk=13.7.0-rc3
Asterisk=1.8.28
Asterisk=11.6-cert1
Asterisk=11.6-cert1
Asterisk=11.6-cert1_rc2
Asterisk=11.6-cert10
Asterisk=11.6-cert11
Asterisk=11.6-cert2
Asterisk=11.6-cert2
Asterisk=11.6-cert3
Asterisk=11.6-cert3
Asterisk=11.6-cert4
Asterisk=11.6-cert5
Asterisk=11.6-cert6
Asterisk=11.6-cert7
Asterisk=11.6-cert8
Asterisk=11.6-cert9
Asterisk=11.6.0
Asterisk=11.6.0
Asterisk=11.6.0-rc1
Asterisk=11.6.0-rc2
Asterisk=13.1
Asterisk=13.1-cert1
Asterisk=13.1-cert2
Asterisk=13.1.0
Asterisk=13.1.0-rc1
Asterisk=13.1.0-rc2

Remediation

Patch Available

http://downloads.asterisk.org/pub/security/AST-2016-002.html

Event History

Feb 22, 2016
CVE Published
via MITRE·03:05 PM
Data Sourced
via MITRE·03:05 PM
Description

Frequently Asked Questions

1

What is the severity of CVE-2016-2316?

CVE-2016-2316 has a high severity rating as it allows remote attackers to cause a denial of service condition.

2

How do I fix CVE-2016-2316?

To fix CVE-2016-2316, upgrade to Asterisk version 11.21.1 or later, 12.x, or 13.7.1 or later.

3

Which Asterisk versions are affected by CVE-2016-2316?

CVE-2016-2316 affects Asterisk versions 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1.

4

What kind of attacks can CVE-2016-2316 lead to?

CVE-2016-2316 can lead to denial of service attacks by processing SIP packets with an improperly configured timert1.

5

Is there a specific configuration issue related to CVE-2016-2316?

Yes, the issue arises when the timert1 configuration in sip.conf is set to a value greater than 1245.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203