CVE-2018-7284: Buffer Overflow
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the respjsippubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:16.2.1~dfsg-1+deb10u2Fixed in 1:16.28.0~dfsg-0+deb10u3Fixed in 1:16.28.0~dfsg-0+deb11u3Fixed in 1:20.4.0~dfsg+~cs6.13.40431414-2 - Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:13.20.0~dfsg-1Fixed in 1:13.14.1~dfsg-2+deb9u4 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 13.19.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 14.7.5 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 15.2.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 13.18-cert2 - Configuration
Ensure the res_pjsip_pubsub SUBSCRIBE request handling limits the number of Accept headers processed to 32 (the fixed limit mentioned in the advisory) to avoid processing more than 32 Accept headers, which can trigger the buffer overflow.
Asterisk (res_pjsip_pubsub) Maximum Accept headers processed for SUBSCRIBE = 32
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-7284.
What is the severity of CVE-2018-7284?
The severity of CVE-2018-7284 is high.
Which software versions are affected by CVE-2018-7284?
Asterisk versions through 13.19.1, 14.x through 14.7.5, 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2 are affected by CVE-2018-7284.
How can I fix CVE-2018-7284?
To fix CVE-2018-7284, it is recommended to update to the appropriate patched versions of Asterisk or Certified Asterisk as mentioned in the references.
Where can I find more information about CVE-2018-7284?
More information about CVE-2018-7284 can be found in the references provided: http://downloads.asterisk.org/pub/security/AST-2018-004.html, http://www.securityfocus.com/bid/103151, http://www.securitytracker.com/id/1040416.