Skip to content
OpenAdvisories
Unscored Public exploit CVE-2018-7284 EUVD-2018-19018GHSA-h9x3-h6rr-35ww

A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk th…

Published Feb 22, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: asterisk Package: asterisk Ecosystem: Debian Ecosystem: Ubuntu

Description

A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 asterisk 1:13.20.0~dfsg-1 —
Debian 9 asterisk 1:13.14.1~dfsg-2+deb9u4 DSA-4320-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS asterisk No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS asterisk No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 1 repository

  • Rodrigo-D/astDoS ★ 0 · Sep 15, 2019

    Tool to exploit CVE-2018-7284 and CVE-2018-19278

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 2

References