An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4, and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a packet that contains an unsupported media format, a crash can occur.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4999 advisory.

  - An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4,     and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a     packet that contains an unsupported media format, a crash can occur. (CVE-2021-32558)

  - PJSIP is a free and open source multimedia communication library written in C language implementing     standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there     are a couple of issues found in the SSL socket. First, a race condition between callback and destroy, due     to the accepted socket having no group lock. Second, the SSL socket parent/listener may get destroyed     during handshake. Both issues were reported to happen intermittently in heavy load TLS connections. They     cause a crash, resulting in a denial of service. These are fixed in version 2.11.1. (CVE-2021-32686)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2729 advisory.

  - An issue was discovered in Sangoma Asterisk 13.x before 13.38.3, 16.x before 16.19.1, 17.x before 17.9.4,     and 18.x before 18.5.1, and Certified Asterisk before 16.8-cert10. If the IAX2 channel driver receives a     packet that contains an unsupported media format, a crash can occur. (CVE-2021-32558)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Asterisk project reports :

If the IAX2 channel driver receives a packet that contains an unsupported media format it can cause a crash to occur in Asterisk.

ID	Name	Product	Family	Severity
154818	Debian DSA-4999-1 : asterisk - security update	Nessus	Debian Local Security Checks	high
152215	Debian DLA-2729-1 : asterisk - LTS security update	Nessus	Debian Local Security Checks	high
152070	FreeBSD : asterisk -- Remote crash when using IAX2 channel driver (fb3455be-ebf6-11eb-aef1-0897988a1c07)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2021-32558

high

Tenable Plugins

high

high

high