Bugzilla – Bug 1084606
VUL-0: CVE-2018-1000099: asterisk: segmentation fault with an invalid SDP fmtp attribute
Last modified: 2019-12-18 15:08:05 UTC
rh#1548126 A flaw was discovered in Asterisk 13.x, 14.x, 15.x and 13.18. By crafting an SDP message body with an invalid fmtp attribute Asterisk crashes when using the pjsip channel driver because pjproject's fmtp retrieval function fails to check if fmtp value is empty (set empty if previously parsed as invalid). References: http://downloads.asterisk.org/pub/security/AST-2018-003.html https://issues.asterisk.org/jira/browse/ASTERISK-27583 Patches: http://downloads.asterisk.org/pub/security/AST-2018-003-13.diff [Asterisk 13] http://downloads.asterisk.org/pub/security/AST-2018-003-14.diff [Asterisk 14] http://downloads.asterisk.org/pub/security/AST-2018-003-15.diff [Asterisk 15] http://downloads.asterisk.org/pub/security/AST-2018-003-13.18.diff [Certified Asterisk 13.18] References: https://bugzilla.redhat.com/show_bug.cgi?id=1548126 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000099 http://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-1000099.html
tool is no longer in use