GHSA-746q-794h-cc7f: Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the chanooh323 Q.931 information-element parser permits an out-of-bounds read that may allow an unauthenticated attacker to crash Asterisk using carefully crafted setup packets. The chanooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 20.20.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 20.7-cert11 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Only Asterisk deployments with the chan_ooh323 addon channel driver explicitly compiled and installed are affected. The addon is not installed by default, and its port must be publicly reachable for a remote attacker to reach it.
What does an attacker need to exploit the issue?
An attacker does not need authentication or user interaction. They need network access to the publicly reachable chan_ooh323 port and must send carefully crafted Q.931 setup packets.
What is the likely impact of successful exploitation?
A successful attack may crash Asterisk through an out-of-bounds read in the Q.931 information-element parser. The provided information identifies an availability impact and does not describe confidentiality or integrity impact.
What should be done if an affected deployment cannot be upgraded immediately?
Prevent untrusted networks from reaching the chan_ooh323 port, since public reachability is required for remote exploitation. If H.323 support is not needed, removing or disabling the explicitly installed chan_ooh323 addon eliminates the exposed component.