The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3925 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3925-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                    Thorsten Alteholz     October 20, 2024                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : asterisk     Version        : 1:16.28.0~dfsg-0+deb11u5     CVE ID         : CVE-2024-42365 CVE-2024-42491


    Two issues have been found in asterisk, an Open Source Private Branch     Exchange.


    CVE-2024-42365

        Due to a privilege escalation, remote code execution and/or         blind server-side request forgery with arbitrary protocol are         possible.

    CVE-2024-42491

        Due to bad handling of malformed Contact or Record-Route URI in an         incoming  SIP request, Asterisk might crash when res_resolver_unbound         is used.

    Thanks to Niels Galjaard, a minor privilege escalation has been fixed.
    More information about ths can be found at:

    https://alioth-lists.debian.net/pipermail/pkg-voip-maintainers/2024-July/038664.html


    For Debian 11 bullseye, these problems have been fixed in version     1:16.28.0~dfsg-0+deb11u5.

    We recommend that you upgrade your asterisk packages.

    For the detailed security status of asterisk please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/asterisk

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3925 : asterisk - security update

high Nessus Plugin ID 209341

Version 1.1