Description
chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:13.7.2~dfsg-1 | — |
| Debian 8 | asterisk | 1:11.13.1~dfsg-2+deb8u1 | DSA-3700-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | asterisk | No fix yet | — |
Advisories 1
- DSA-3700-1 asterisk - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- 82651 vdb-entry
- 1034930 vdb-entry
- FEDORA-2016-3cc13611f4 vendor-advisory
- FEDORA-2016-153eed2bb8 vendor-advisory
- DSA-3700 vendor-advisory
- http://downloads.asterisk.org/pub/security/AST-2016-002.html