CVE-2019-18790: Medium severity asterisk vulnerability
An issue was discovered in channels/chansip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or autoforcerport.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-18790?
The severity of CVE-2019-18790 is medium (6.5).
Which software versions are affected by CVE-2019-18790?
The affected software versions are Digium Asterisk 13.x (before 13.29.2), 16.x (before 16.6.2), 17.x (before 17.0.1), and Digium Certified Asterisk 13.21 (before cert5).
What is the vulnerability description of CVE-2019-18790?
CVE-2019-18790 is a vulnerability in Sangoma Asterisk that allows an attacker to change a SIP peer's IP address via a SIP request without the need for a REGISTER.
Are there any references available for CVE-2019-18790?
Yes, you can find the references for CVE-2019-18790 at the following links: [link1], [link2], [link3].
How can I fix CVE-2019-18790?
To fix CVE-2019-18790, update to Sangoma Asterisk version 13.29.2, 16.6.2, 17.0.1, or Certified Asterisk 13.21 cert5.