Integer overflow in pjsip - CVE-2021-37706
Published: February 24, 2022
Vulnerability identifier: #VU60857
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-37706
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to integer overflow within STUN message that contains an ERROR-CODE attribute. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
pjsip
Gentoo Linux
Debian Linux
Ubuntu
Asterisk Open Source
Certified Asterisk
ring-daemon (Ubuntu package)
ring (Ubuntu package)
pjproject (Ubuntu package)
net-libs/pjproject
asterisk (Debian package)
jami-daemon (Ubuntu package)
jami (Ubuntu package)
Gentoo Linux
Debian Linux
Ubuntu
Asterisk Open Source
Certified Asterisk
ring-daemon (Ubuntu package)
ring (Ubuntu package)
pjproject (Ubuntu package)
net-libs/pjproject
asterisk (Debian package)
jami-daemon (Ubuntu package)
jami (Ubuntu package)
How to mitigate CVE-2021-37706
Install updates from vendor's website.
pjsip - update to 2.12
Asterisk Open Source - addressed in versions 16.24.1, 18.10.1, 19.2.1
Certified Asterisk - update to 16.8-cert13
ring-daemon (Ubuntu package) - addressed in versions Ubuntu Pro, 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1
ring (Ubuntu package) - addressed in versions Ubuntu Pro, 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1
pjproject (Ubuntu package) - addressed in versions 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1, 2.7.2~dfsg-1ubuntu0.1~esm1
net-libs/pjproject - update to 2.12.1
asterisk (Debian package) - update to 1:16.28.0~dfsg-0+deb11u1
jami-daemon (Ubuntu package) - addressed in versions 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1, 20230206.0~ds1-5ubuntu0.1, 20230206.0~ds2-1.3ubuntu0.1
jami (Ubuntu package) - addressed in versions 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1, 20230206.0~ds1-5ubuntu0.1, 20230206.0~ds2-1.3ubuntu0.1
Asterisk Open Source - addressed in versions 16.24.1, 18.10.1, 19.2.1
Certified Asterisk - update to 16.8-cert13
ring-daemon (Ubuntu package) - addressed in versions Ubuntu Pro, 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1
ring (Ubuntu package) - addressed in versions Ubuntu Pro, 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1
pjproject (Ubuntu package) - addressed in versions 2.1.0.0.ast20130823-1+deb8u1ubuntu0.1~esm1, 2.7.2~dfsg-1ubuntu0.1~esm1
net-libs/pjproject - update to 2.12.1
asterisk (Debian package) - update to 1:16.28.0~dfsg-0+deb11u1
jami-daemon (Ubuntu package) - addressed in versions 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1, 20230206.0~ds1-5ubuntu0.1, 20230206.0~ds2-1.3ubuntu0.1
jami (Ubuntu package) - addressed in versions 20190215.1.f152c98~ds1-1+deb10u2build0.20.04.1, 20230206.0~ds1-5ubuntu0.1, 20230206.0~ds2-1.3ubuntu0.1