CVE-2020-35776

A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 28%
VendorProductVersion
digiumasterisk
13.0.0 ≤
𝑥
≤ 13.38.1
digiumasterisk
16.0.0 ≤
𝑥
≤ 16.15.1
digiumasterisk
17.0.0 ≤
𝑥
≤ 17.9.1
digiumasterisk
18.0 ≤
𝑥
≤ 18.1.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
asterisk
bullseye
1:16.28.0~dfsg-0+deb11u4
fixed
buster
postponed
stretch
no-dsa
bullseye (security)
1:16.28.0~dfsg-0+deb11u5
fixed
sid
1:22.0.0~dfsg+~cs6.14.60671435-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
asterisk
noble
needs-triage
mantic
ignored
lunar
ignored
kinetic
ignored
jammy
needs-triage
impish
ignored
hirsute
ignored
groovy
ignored
focal
needs-triage
bionic
needs-triage
xenial
needs-triage
trusty
dne
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/161470/Asterisk-Project-Security-Advisory-AST-2021-001.html
http://seclists.org/fulldisclosure/2021/Feb/57
https://downloads.asterisk.org/pub/security/AST-2021-001.html
https://issues.asterisk.org/
https://issues.asterisk.org/jira/browse/ASTERISK-29227
http://packetstormsecurity.com/files/161470/Asterisk-Project-Security-Advisory-AST-2021-001.html
http://seclists.org/fulldisclosure/2021/Feb/57
https://downloads.asterisk.org/pub/security/AST-2021-001.html
https://issues.asterisk.org/
https://issues.asterisk.org/jira/browse/ASTERISK-29227