SB2017090101 - Multiple vulnerability in Digium Asterisk

Description

This security bulletin contains information about 3 vulnerabilities.

1) Session hijacking (CVE-ID: CVE-2017-14099)

CWE-ID: CWE-384 - Session Fixation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker to hijack the target user's media session.

The weakness exists due to a flaw in the strict RTP support feature. A remote attacker can send specially crafted RTP traffic to provide and receive media from the session.

2) Command injection (CVE-ID: CVE-2017-14100)

CWE-ID: CWE-77 - Command injection

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Amber

The vulnerability allows a remote authenticated attacker to execute arbitrary commands on the target system.

The weakness exists due to input validation flaw in the 'app_minivm' module. A remote attacker can send supply specially crafted caller-id name and number data and execute arbitrary operating system commands.

Successful exploitation of the vulnerability may result in system compromise.

3) Improper input validation (CVE-ID: CVE-2017-14098)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote attacker can cause DoS condition on the target system.

The weakness exists due to a flaw in 'pjsip_message_ip_updater'. A remote attacker can submit a specially crafted URI in a 'From', 'To', and 'Contact' header and cause the application to crash.

Successful exploitation of the vulnerability results in denial of service.

Remediation

Install update from vendor's website.

References

• http://downloads.asterisk.org/pub/security/AST-2017-005.html
• http://downloads.asterisk.org/pub/security/AST-2017-006.html
• http://downloads.asterisk.org/pub/security/AST-2017-007.html