Vulnerability identifier: #VU10713

Vulnerability risk: Low

CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2018-7286

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Asterisk Open Source
Server applications / Conferencing, Collaboration and VoIP solutions

Vendor: Digium (Linux Support Services)

Description
The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists due to improper processing of INVITE messages received via the TCP or Transport Layer Security (TLS) protocols. A remote attacker can send a series of specially crafted INVITE messages over a TCP or TLS connection, trigger a segmentation fault and cause the system to crash.

Mitigation
Update to version 13.19.2, 14.7.6, 15.2.2.

Vulnerable software versions

Asterisk Open Source: 15.0.0 - 15.2.1, 13.0.0 - 13.18.5, 14.0 - 14.7.5

---

External links
http://downloads.asterisk.org/pub/security/AST-2018-005.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.