CVE-2022-37325
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.
Risk Assessment
An attacker can remotely crash the Asterisk server, leading to disruption of telephony services and potential loss of availability.
Recommendation
Immediately upgrade Asterisk to version 16.28.1, 18.14.1, 19.6.1 or later, which includes a fix for this vulnerability.
Other vulnerabilities in Asterisk
See all- CVE-2017-17850High
An issue was discovered in Asterisk versions 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older that causes a crash when processing certain SIP messages without a contact header. This issue occurs only when the PJSIP channel driver is used.
- CVE-2017-14603High
In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2, insufficient RTCP packet validation could allow reading stale buffer contents. When combined with the 'nat' and 'symmetric_rtp' options, this could allow redirecting where Asterisk sends the next RTCP report.
Original NVD description (English source)
In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.