Vulnerabilities > CVE-2016-2316 - Integer Underflow (Wrap or Wraparound) vulnerability in multiple products
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
COMPLETE Summary
chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Nessus
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_559F3D1BCB1D11E580A4001999F8D30B.NASL description The Asterisk project reports : AST-2016-001 - BEAST vulnerability in HTTP server AST-2016-002 - File descriptor exhaustion in chan_sip AST-2016-003 - Remote crash vulnerability when receiving UDPTL FAX data last seen 2020-06-01 modified 2020-06-02 plugin id 88584 published 2016-02-05 reporter This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/88584 title FreeBSD : asterisk -- Multiple vulnerabilities (559f3d1b-cb1d-11e5-80a4-001999f8d30b) (BEAST) NASL family Fedora Local Security Checks NASL id FEDORA_2016-3CC13611F4.NASL description Update to upstream 13.7.1 release for security fixes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2016-03-04 plugin id 89519 published 2016-03-04 reporter This script is Copyright (C) 2016-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/89519 title Fedora 22 : asterisk-13.7.1-1.fc22 (2016-3cc13611f4) NASL family Fedora Local Security Checks NASL id FEDORA_2016-153EED2BB8.NASL description Update to upstream 13.7.1 release for security fixes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2016-03-04 plugin id 89481 published 2016-03-04 reporter This script is Copyright (C) 2016-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/89481 title Fedora 23 : asterisk-13.7.1-1.fc23 (2016-153eed2bb8) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-3700.NASL description Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service or incorrect certificate validation. last seen 2020-06-01 modified 2020-06-02 plugin id 94259 published 2016-10-26 reporter This script is Copyright (C) 2016-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/94259 title Debian DSA-3700-1 : asterisk - security update
References
- http://downloads.asterisk.org/pub/security/AST-2016-002.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177409.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177422.html
- http://www.debian.org/security/2016/dsa-3700
- http://www.securityfocus.com/bid/82651
- http://www.securitytracker.com/id/1034930