CVE-2018-7286: Medium severity Digium Asterisk vulnerability
An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. respjsip allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:16.2.1~dfsg-1+deb10u2Fixed in 1:16.28.0~dfsg-0+deb10u3Fixed in 1:16.28.0~dfsg-0+deb11u3Fixed in 1:20.4.0~dfsg+~cs6.13.40431414-2 - Upgrade
Upgrade
debian/asteriskto a version that resolves this vulnerability.Fixed in 1:13.20.0~dfsg-1Fixed in 1:13.14.1~dfsg-2+deb9u4
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7286?
The severity of CVE-2018-7286 is medium with a CVSS score of 6.5.
How does CVE-2018-7286 affect Asterisk?
CVE-2018-7286 allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection.
What versions of Asterisk are affected by CVE-2018-7286?
Asterisk versions through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, as well as Certified Asterisk through 13.18 are affected by CVE-2018-7286.
How can I fix CVE-2018-7286?
To fix CVE-2018-7286, update to Asterisk versions 13.20.0 or later for Debian, or 16.2.1 or later for Debian 10 and Debian 11.
Where can I find more information about CVE-2018-7286?
You can find more information about CVE-2018-7286 at the following references: [AST-2018-005](http://downloads.asterisk.org/pub/security/AST-2018-005.html), [BID-103129](http://www.securityfocus.com/bid/103129), [SecurityTracker-1040417](http://www.securitytracker.com/id/1040417).