Description
Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:11.7.0~dfsg-1 | — |
| Debian 7 | asterisk | 1:1.8.13.1~dfsg1-3+deb7u3 | DSA-2835-1 |
| Debian 6.0 | asterisk | 1:1.6.2.9-2+squeeze12 | DSA-2835-1 |
Advisories 1
- DSA-2835-1 asterisk - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- MDVSA-2013:300 vendor-advisory
- 20131216 AST-2013-006: Buffer Overflow when receiving odd length 16 bit SMS message mailing-list
- https://issues.asterisk.org/jira/browse/ASTERISK-22590
- 56294 third-party-advisory
- http://downloads.asterisk.org/pub/security/AST-2013-006.html
- 1029499 vdb-entry
- 101100 vdb-entry
- DSA-2835 vendor-advisory
- 64364 vdb-entry
- asterisk-sms-message-dos(89825) vdb-entry