Walter Doekes

**Name of the Vulnerable Software and Affected Versions** Asterisk Open Source versions 11.x through 11.25.1 Asterisk Open Source versions 13.x through 13.13.1 Asterisk Open Source versions 14.x through 14.2.1 Certified Asterisk versions 11.x through 11.6-cert16 Certified Asterisk versions 13.x through 13.8-cert4 **Description** The issue is related to the chan sip channel driver, which has a liberal definition for whitespace when stripping content between a SIP header name and a colon character. This can cause problems when Asterisk is used with an authenticating SIP proxy, allowing an INVITE request into Asterisk without authentication. The result is that Asterisk can process calls from unvetted sources without any authentication. **Recommendations** For Asterisk Open Source versions 11.x through 11.25.1, update to version 11.25.1 or later. For Asterisk Open Source versions 13.x through 13.13.1, update to version 13.13.1 or later. For Asterisk Open Source versions 14.x through 14.2.1, update to version 14.2.1 or later. For Certified Asterisk versions 11.x through 11.6-cert16, update to version 11.6-cert16 or later. For Certified Asterisk versions 13.x through 13.8-cert4, update to version 13.8-cert4 or later. As a temporary workaround, consider using chan pjsip instead of chan sip, or ensure that your proxy is dialog-aware to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Asterisk Open Source versions 1.8.x through 1.8.22 Asterisk Open Source versions 10.x through 10.12.2 Asterisk Open Source versions 11.x through 11.4 Certified Asterisk versions 1.8.15 through 1.8.15-cert2 Certified Asterisk versions 11.2 through 11.2-cert1 Asterisk Digiumphones versions 10.x-digiumphones through 10.12.2-digiumphones **Description** The issue allows remote attackers to cause a denial of service via an invalid SDP in a SIP request. This can result in a NULL pointer dereference, segmentation fault, and daemon crash. The estimated number of potentially affected devices and details about real-world incidents are not provided. **Recommendations** For Asterisk Open Source versions 1.8.x through 1.8.22, update to version 1.8.23.1 or later. For Asterisk Open Source versions 10.x through 10.12.2, update to version 10.12.3 or later. For Asterisk Open Source versions 11.x through 11.4, update to version 11.5.1 or later. For Certified Asterisk versions 1.8.15 through 1.8.15-cert2, update to version 1.8.15-cert3 or later. For Certified Asterisk versions 11.2 through 11.2-cert1, update to version 11.2-cert2 or later. For Asterisk Digiumphones versions 10.x-digiumphones through 10.12.2-digiumphones, update to version 10.12.3-digiumphones or later.

**Name of the Vulnerable Software and Affected Versions** Asterisk Open Source versions 1.8.x through 1.8.20.1 Asterisk Open Source versions 10.x through 10.12.1 Asterisk Open Source versions 11.x through 11.2.1 Certified Asterisk versions 1.8.15 through 1.8.15-cert1 Asterisk Business Edition (BE) versions C.3.x through C.3.8.0 Asterisk Digiumphones versions 10.x-digiumphones through 10.12.2-digiumphones **Description** The SIP channel driver in Asterisk exhibits different behavior for invalid INVITE, SUBSCRIBE, and REGISTER transactions depending on whether the user account exists. This allows remote attackers to enumerate account names by reading HTTP status codes, reading additional text in a 403 response, or observing whether certain retransmissions occur. **Recommendations** For Asterisk Open Source versions 1.8.x through 1.8.20.1, update to version 1.8.20.2 or later. For Asterisk Open Source versions 10.x through 10.12.1, update to version 10.12.2 or later. For Asterisk Open Source versions 11.x through 11.2.1, update to version 11.2.2 or later. For Certified Asterisk versions 1.8.15 through 1.8.15-cert1, update to version 1.8.15-cert2 or later. For Asterisk Business Edition (BE) versions C.3.x through C.3.8.0, update to version C.3.8.1 or later. For Asterisk Digiumphones versions 10.x-digiumphones through 10.12.2-digiumphones, update to a version that includes the fix for this issue.