#VU10713 Denial of service in Asterisk Open Source

Published: 2021-06-17

Vulnerability identifier: #VU10713

Vulnerability risk: Low


CVE-ID: CVE-2018-7286


Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Asterisk Open Source
Server applications / Conferencing, Collaboration and VoIP solutions

Vendor: Digium (Linux Support Services)

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists due to improper processing of INVITE messages received via the TCP or Transport Layer Security (TLS) protocols. A remote attacker can send a series of specially crafted INVITE messages over a TCP or TLS connection, trigger a segmentation fault and cause the system to crash.

Update to version 13.19.2, 14.7.6, 15.2.2.

Vulnerable software versions

Asterisk Open Source: 15.0.0 - 15.2.1, 13.0.0 - 13.18.5, 14.0 - 14.7.5


External links

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

Latest bulletins with this vulnerability