Asterisk Development Team
2019-Nov-21 22:45 UTC
[asterisk-announce] Asterisk 13.29.2, 16.6.2, 17.0.1 and 13.21-cert5 Now Available (Security)
The Asterisk Development Team would like to announce security releases for Asterisk 13, 16 and 17, and Certified Asterisk 13.21. The available releases are released as versions 13.29.2, 16.6.2, 17.0.1 and 13.21-cert5. These releases are available for immediate download at https://downloads.asterisk.org/pub/telephony/asterisk/releases https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases The following security vulnerabilities were resolved in these versions: * AST-2019-006: SIP request can change address of a SIP peer. A SIP request can be sent to Asterisk that can change a SIP peer���s IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer���s name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the ���nat��� option is set to the default, or ���auto_force_rport���. * AST-2019-007: AMI user could execute system commands. A remote authenticated Asterisk Manager Interface (AMI) user without ���system��� authorization could use a specially crafted ���Originate��� AMI request to execute arbitrary system commands. * AST-2019-008: Re-invite with T.38 and malformed SDP causes crash. If Asterisk receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a crash will occur. For a full list of changes in the current releases, please see the ChangeLogs: https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.29.2 https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-16.6.2 https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-17.0.1 https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.21-cert5 The security advisories are available at: https://downloads.asterisk.org/pub/security/AST-2019-006.pdf https://downloads.asterisk.org/pub/security/AST-2019-007.pdf https://downloads.asterisk.org/pub/security/AST-2019-008.pdf Thank you for your continued support of Asterisk! -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.digium.com/pipermail/asterisk-announce/attachments/20191121/10ade929/attachment.html>
Maybe Matching Threads
- AST-2019-006: SIP request can change address of a SIP peer.
- AST-2019-007: AMI user could execute system commands.
- AST-2019-008: Re-invite with T.38 and malformed SDP causes crash.
- Asterisk Release certified-18.9-cert5
- Asterisk Release certified-18.9-cert5