GHSA-8jw3-ccr9-xrmf: Asterisk: Buffer over-read in Asterisk PJSIP MWI body parser
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a carefully crafted SIP NOTIFY request. The attacker must pass SIP authentication using either a username/password or source IP address matching. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 20.20.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 20.7-cert11 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to send SIP NOTIFY requests and pass SIP authentication. Authentication can be satisfied with a username and password or by connecting from a source IP address that matches an allowed configuration.
What is the practical impact of successful exploitation?
A successful attacker can crash the affected Asterisk instance, resulting in a denial of service. The provided data does not indicate confidentiality or integrity impact.
Are installations using default settings affected?
The provided information does not state whether the vulnerable PJSIP MWI body parser is enabled or reachable in a default configuration. Exposure depends on whether an attacker can authenticate for SIP NOTIFY handling.
Which releases contain fixes?
Fixes are available in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, and in Certified Asterisk 20.7-cert11 and 22.8-cert3.