CVE-2016-9937

High

Published: 12/12/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

An issue was discovered in Asterisk Open Source versions 13.12.x, 13.13.x before 13.13.1, and 14.x before 14.2.1 related to the handling of the Opus codec. Receiving an SDP offer or answer with format parameters separated by spaces causes the code to recursively call itself, leading to a crash.

Risk Assessment

The organization may experience a crash of the Asterisk system, potentially leading to communication disruptions. This issue does not require user authentication or Opus codec configuration.

Recommendation

It is recommended to update Asterisk to versions 13.13.1 or 14.2.1 to mitigate this vulnerability. Additionally, consider restricting guest access in SIP and PJSIP channels.

Other vulnerabilities in Asterisk Open Source

CVE-2014-8413High
The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, allowing remote attackers to bypass intended PJSIP ACL rules.

Original NVD description (English source)

An issue was discovered in Asterisk Open Source 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1. If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the parameters. This does NOT require the endpoint to have Opus configured in Asterisk. This also does not require the endpoint to be authenticated. If guest is enabled for chan_sip or anonymous in chan_pjsip an SDP offer or answer is still processed and the crash occurs.