Vulnerability identifier: #VU10713

Vulnerability risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-7286

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Asterisk Open Source
Server applications / Conferencing, Collaboration and VoIP solutions

Vendor: Digium (Linux Support Services)

Description
The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The weakness exists due to improper processing of INVITE messages received via the TCP or Transport Layer Security (TLS) protocols. A remote attacker can send a series of specially crafted INVITE messages over a TCP or TLS connection, trigger a segmentation fault and cause the system to crash.

Mitigation
Update to version 13.19.2, 14.7.6, 15.2.2.

Vulnerable software versions

Asterisk Open Source: 15.0.0 - 15.2.1, 13.0.0 - 13.18.5, 14.0 - 14.7.5

---

CPE

• cpe:2.3:a:digium_linux_support_services:asterisk:15.1.2:*:*:*:*:*:*:*

External links
http://downloads.asterisk.org/pub/security/AST-2018-005.html

---

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?