Asterisk PJSIP Channel Driver Multiple DoS Vulnerabilities (AST-2014-005 / AST-2014-008)

medium Nessus Plugin ID 76089

Language:

Synopsis

A telephony application running on the remote host is affected by multiple denial of service vulnerabilities.

Description

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by the following denial of service vulnerabilities in the PJSIP channel driver :

- A flaw exists in the publish / subscribe framework when an attempt to unsubscribe is made when not already subscribed. A remote attacker could exploit this flaw to cause a denial of service. (CVE-2014-4045)

- A flaw exists when handling a SIP transaction timeout which may cause SIP traffic to not be processed. This could allow a remote, authenticated attacker subscribe to a resource in Asterisk and immediately disconnect, resulting in a denial of service. (CVE-2014-4048)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Asterisk 12.3.1 or apply the appropriate patch listed in the Asterisk advisory.

Plugin Details

Severity: Medium

ID: 76089

File Name: asterisk_ast_2014_008.nasl

Version: 1.10

Type: remote

Family: Misc.

Published: 6/17/2014

Updated: 4/11/2022

Configuration: Enable paranoid mode, Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P

CVSS Score Source: CVE-2014-4048

Vulnerability Information

CPE: cpe:/a:digium:asterisk

Required KB Items: asterisk/sip_detected, Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 6/12/2014

Vulnerability Publication Date: 6/12/2014

Reference Information

CVE: CVE-2014-4045, CVE-2014-4048

BID: 68033, 68032

Detections

Analytics