The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.17.x through 1.8.22.x, 1.8.23.x before 1.8.23.1, and 11.x before 11.5.1 and Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an ACK with SDP to a previously terminated channel. NOTE: some of these details are obtained from third party information.

The remote host is affected by the vulnerability described in GLSA-201401-15 (Asterisk: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Asterisk. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code with the privileges of       the process, cause a Denial of Service condition, or obtain sensitive       information.
  Workaround :

    There is no known workaround at this time.

- Thu Aug 29 2013 Jeffrey Ollie <jeff at ocjtech.us> -     11.5.1-2 :

    - Enable hardened build BZ#954338

    - Significant clean ups

  - Thu Aug 29 2013 Jeffrey Ollie <jeff at ocjtech.us> -     11.5.1-1 :

    - The Asterisk Development Team has announced security       releases for Certified

    - Asterisk 1.8.15, 11.2, and Asterisk 1.8, 10, and 11.
      The available security releases

    - are released as versions 1.8.15-cert2, 11.2-cert2,       1.8.23.1, 10.12.3, 10.12.3-digiumphones,

    - and 11.5.1.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a denial of service vulnerability. The application does not properly handle 'ACK' messages with SDP after a channel has been closed.

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a denial of service vulnerability. 

The application does not properly handle 'ACK' messages with SDP after a channel has been closed.

Colin Cuthbertson and Walter Doekes discovered two vulnerabilities in the SIP processing code of Asterisk - an open source PBX and telephony toolkit -, which could result in denial of service.

Updated asterisk packages fix security vulnerabilities :

A remotely exploitable crash vulnerability exists in the SIP channel driver if an ACK with SDP is received after the channel has been terminated. The handling code incorrectly assumes that the channel will always be present (CVE-2013-5641).

A remotely exploitable crash vulnerability exists in the SIP channel driver if an invalid SDP is sent in a SIP request that defines media descriptions before connection information. The handling code incorrectly attempts to reference the socket address information even though that information has not yet been set (CVE-2013-5642).

The Asterisk project reports :

Remote Crash From Late Arriving SIP ACK With SDP

Remote Crash when Invalid SDP is sent in SIP Request

ID	Name	Product	Family	Severity
72054	GLSA-201401-15 : Asterisk: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
69887	Fedora 18 : asterisk-11.5.1-2.fc18 (2013-15567)	Nessus	Fedora Local Security Checks	medium
69886	Fedora 19 : asterisk-11.5.1-2.fc19 (2013-15560)	Nessus	Fedora Local Security Checks	medium
8006	Asterisk SIP Channel Driver ACK with SDP Denial of Service (AST-2013-004)	Nessus Network Monitor	Generic	medium
69558	Asterisk SIP Channel Driver ACK with SDP Denial of Service (AST-2013-004)	Nessus	Misc.	medium
69542	Debian DSA-2749-1 : asterisk - several vulnerabilities	Nessus	Debian Local Security Checks	medium
69540	Mandriva Linux Security Advisory : asterisk (MDVSA-2013:223)	Nessus	Mandriva Local Security Checks	medium
69499	FreeBSD : asterisk -- multiple vulnerabilities (fd2bf3b5-1001-11e3-ba94-0025905a4771)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-5641

high

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium