Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2019-7251: Asterisk can crash when authenticated user sends bad SDP
CVE-2019-7251 · published 7 years ago
Summary
Versions of Digium Asterisk up to 15.7.1 and 16.1.1 have a coding mistake in the part that handles call setup information. An attacker who has a valid login can send specially crafted data that forces the phone system to stop working. Update Asterisk to the latest release or apply the vendor’s patch and limit remote login access to trusted users.
What to do
- Update alpine asterisk to version 16.3.0-r0.
- Update alpine asterisk to version 15.6.2-r0.
- Update alpine asterisk to version 15.7.4-r0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Alpine:v3.10 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.11 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.12 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.13 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.14 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.15 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.16 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.17 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.18 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.19 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.20 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.21 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.22 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.23 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.24 | alpine | asterisk |
>= 15.0.0, < 16.3.0-r0 Fix: upgrade to 16.3.0-r0
|
| Alpine:v3.7 | alpine | asterisk |
>= 15.0.0, < 15.6.2-r0 Fix: upgrade to 15.6.2-r0
|
| Alpine:v3.8 | alpine | asterisk |
>= 15.0.0, < 15.6.2-r0 Fix: upgrade to 15.6.2-r0
|
| Alpine:v3.9 | alpine | asterisk |
>= 15.0.0, < 15.7.4-r0 Fix: upgrade to 15.7.4-r0
|
| – | digium | asterisk |
>= 15.0.0, < 15.7.2 >= 16.0.0, < 16.2.1 cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:* |
Original advisory text
An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Aste...
An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via a specially crafted SDP protocol violation.
References
- https://downloads.asterisk.org/pub/security/AST-2019-001.html Patch Vendor Advisory
- https://issues.asterisk.org/jira/browse/ASTERISK-28260 Issue Tracking Vendor Advisory
- https://security.alpinelinux.org/vuln/CVE-2019-7251 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-190Integer Overflow
Timeline
Published28 Mar 2019
Updated4 Nov 2026
First seen10 Sep 2026
Track software like this
Free during beta