Description
main/rtp.c in Asterisk Open Source 1.6.1 before 1.6.1.2 allows remote attackers to cause a denial of service (crash) via an RTP text frame without a certain delimiter, which triggers a NULL pointer dereference and the subsequent calculation of an invalid pointer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:1.6.2.0~dfsg~rc1-1 | — |
References
- 1022608 vdb-entry
- 56571 vdb-entry
- http://downloads.digium.com/pub/security/AST-2009-004-1.6.1.diff.txt
- asterisk-rtp-dos(52046) vdb-entry
- http://downloads.asterisk.org/pub/security/AST-2009-004.html
- 35837 vdb-entry
- 36039 third-party-advisory
- ADV-2009-2067 vdb-entry