Vulnerability Description
An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash Asterisk (segmentation fault) by sending a number of SIP INVITE messages on a TCP or TLS connection and then suddenly closing the connection.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Digium | Asterisk | >= 14.0.0, <= 14.7.5 |
| Digium | Certified Asterisk | <= 13.18 |
| Debian | Debian Linux | 9.0 |
References
- http://downloads.asterisk.org/pub/security/AST-2018-005.htmlVendor Advisory
- http://www.securityfocus.com/bid/103129Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040417Third Party AdvisoryVDB Entry
- https://issues.asterisk.org/jira/browse/ASTERISK-27618Vendor Advisory
- https://www.debian.org/security/2018/dsa-4320Third Party Advisory
- https://www.exploit-db.com/exploits/44181/ExploitThird Party AdvisoryVDB Entry
- http://downloads.asterisk.org/pub/security/AST-2018-005.htmlVendor Advisory
- http://www.securityfocus.com/bid/103129Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1040417Third Party AdvisoryVDB Entry
- https://issues.asterisk.org/jira/browse/ASTERISK-27618Vendor Advisory
- https://www.debian.org/security/2018/dsa-4320Third Party Advisory
- https://www.exploit-db.com/exploits/44181/ExploitThird Party AdvisoryVDB Entry
FAQ
What is CVE-2018-7286?
CVE-2018-7286 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. res_pjsip allows remote authenticated users to crash Aste...
How severe is CVE-2018-7286?
CVE-2018-7286 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-7286?
Check the references section above for vendor advisories and patch information. Affected products include: Digium Asterisk, Digium Certified Asterisk, Debian Debian Linux.