Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (VoIP)  >   Asterisk Vendors:   Digium (Linux Support Services)
Asterisk SIP ACK With SDP Processing Error Lets Remote Users Deny Service
SecurityTracker Alert ID:  1028956
SecurityTracker URL:
CVE Reference:   CVE-2013-5641   (Links to External Site)
Updated:  Sep 13 2013
Original Entry Date:  Aug 28 2013
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 1.8.x, 11.x
Description:   A vulnerability was reported in Asterisk. A remote user can cause denial of service conditions.

A remote user can send a SIP ACK with SDP that is received after the channel has been terminated to cause the target service to crash.

The vendor was notified on February 11, 2013.

Colin Cuthbertson reported this vulnerability.

Impact:   A remote user can cause the target system to crash.
Solution:   The vendor has issued a fix (, 11.5.1; 1.8.15-cert3, 11.2-cert2).

The vendor's advisory is available at:

Vendor URL: (Links to External Site)
Cause:   State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   None.

 Source Message Contents

Subject:  [Full-disclosure] AST-2013-004: Remote Crash From Late Arriving SIP ACK With SDP

               Asterisk Project Security Advisory - AST-2013-004

          Product         Asterisk                                            
          Summary         Remote Crash From Late Arriving SIP ACK With SDP    
     Nature of Advisory   Remote Crash                                        
       Susceptibility     Remote Unauthenticated Sessions                     
          Severity        Major                                               
       Exploits Known     None                                                
        Reported On       February 11, 2013                                   
        Reported By       Colin Cuthbertson                                   
         Posted On        August 27, 2013                                     
      Last Updated On     August 27, 2013                                     
      Advisory Contact    Joshua Colp <jcolp AT digium DOT com>               
          CVE Name        Pending                                             

    Description  A remotely exploitable crash vulnerability exists in the     
                 SIP channel driver if an ACK with SDP is received after the  
                 channel has been terminated. The handling code incorrectly   
                 assumes that the channel will always be present.             

    Resolution  A check has now been added which only parses SDP and applies  
                it if an Asterisk channel is present.                         
                Note that Walter Doekes, OSSO B.V., is responsible for        
                diagnosing and providing the fix for this issue.              

                               Affected Versions
              Product             Release Series  
        Asterisk Open Source          1.8.x and above          
        Asterisk Open Source           11.x       All versions                
         Certified Asterisk           1.8.15      All versions                
         Certified Asterisk            11.2       All versions                

                                  Corrected In
                 Product                              Release                 
          Asterisk Open Source         , 11.5.1             
           Certified Asterisk                1.8.15-cert3, 11.2-cert2         

                                SVN URL                                  Revision         Asterisk  
                                                                         1.8          Asterisk  
                                                                         11 Certified 
                                                                         1.8.15   Certified 


    Asterisk Project Security Advisories are posted at                                                             
    This document may be superseded by later versions; if so, the latest      
    version will be posted at                                             and                        

                                Revision History
          Date                 Editor                  Revisions Made         
    2013-08-22         Joshua Colp              Initial revision.             

               Asterisk Project Security Advisory - AST-2013-004
              Copyright (c) 2013 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.

Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia -

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, LLC