GHSA-x348-j6c9-77f3: Asterisk: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 ooTrace() trace-logging function can occur when unbounded vsprintf writes into a fixed 2048-byte buffer. A remote attacker may send a carefully crafted packet that causes the Asterisk process to crash. The chanooh323 addon channel driver must be explicitly compiled and installed, which is not the default, and its port must be publicly reachable. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 20.20.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 21.12.3 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 22.10.1 - Upgrade
Upgrade
Asteriskto a version that resolves this vulnerability.Fixed in 23.4.1 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 20.7-cert11 - Upgrade
Upgrade
Certified Asteriskto a version that resolves this vulnerability.Fixed in 22.8-cert3
Event History
Frequently Asked Questions
Which deployments are exposed to remote exploitation?
Exposure requires the chan_ooh323 addon channel driver to have been explicitly compiled and installed, and for its port to be publicly reachable. The addon is not installed by default, so default Asterisk deployments without chan_ooh323 are not affected through this path.
What does an attacker need to do, and what is the expected impact?
An unauthenticated remote attacker can send a carefully crafted packet to the reachable H.323 service. Successful exploitation can crash the Asterisk process, causing denial of service.
Which releases contain the fix?
The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, and 23.4.1, as well as Certified Asterisk 20.7-cert11 and 22.8-cert3.
What can be done if an update cannot be applied immediately?
Remove or disable the explicitly installed chan_ooh323 addon if it is not required. If it must remain enabled, ensure its port is not publicly reachable.