Vulnerabilities > CVE-2017-14099 - Information Exposure vulnerability in Digium Asterisk and Certified Asterisk

047910
CVSS 5.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
NONE
Availability impact
NONE
network
low complexity
digium
CWE-200
nessus

Summary

In res/res_rtp_asterisk.c in Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5, unauthorized data disclosure (media takeover in the RTP stack) is possible with careful timing by an attacker. The "strictrtp" option in rtp.conf enables a feature of the RTP stack that learns the source address of media for a session and drops any packets that do not originate from the expected address. This option is enabled by default in Asterisk 11 and above. The "nat" and "rtp_symmetric" options (for chan_sip and chan_pjsip, respectively) enable symmetric RTP support in the RTP stack. This uses the source address of incoming media as the target address of any sent media. This option is not enabled by default, but is commonly enabled to handle devices behind NAT. A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support, this introduced an avenue where media could be hijacked. Instead of only learning a new address when expected, the new code allowed a new source address to be learned at all times. If a flood of RTP traffic was received, the strict RTP support would allow the new address to provide media, and (with symmetric RTP enabled) outgoing traffic would be sent to this new address, allowing the media to be hijacked. Provided the attacker continued to send traffic, they would continue to receive traffic as well.

Vulnerable Configurations

Part Description Count
Application
Digium
189

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Subverting Environment Variable Values
    The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Exploiting Trust in Client (aka Make the Client Invisible)
    An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
  • Browser Fingerprinting
    An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-3964.NASL
    descriptionMultiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in disclosure of RTP connections or the execution of arbitrary shell commands. For additional information please refer to the upstream advisories: http://downloads.asterisk.org/pub/security/AST-2017-005.html, http://downloads.asterisk.org/pub/security/AST-2017-006.html
    last seen2020-06-01
    modified2020-06-02
    plugin id102931
    published2017-09-05
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102931
    titleDebian DSA-3964-1 : asterisk - security update
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-3964. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(102931);
      script_version("3.7");
      script_cvs_date("Date: 2018/11/10 11:49:38");
    
      script_cve_id("CVE-2017-14099", "CVE-2017-14100");
      script_xref(name:"DSA", value:"3964");
    
      script_name(english:"Debian DSA-3964-1 : asterisk - security update");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Multiple vulnerabilities have been discovered in Asterisk, an open
    source PBX and telephony toolkit, which may result in disclosure of
    RTP connections or the execution of arbitrary shell commands.
    
    For additional information please refer to the upstream advisories:
    http://downloads.asterisk.org/pub/security/AST-2017-005.html,
    http://downloads.asterisk.org/pub/security/AST-2017-006.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://downloads.asterisk.org/pub/security/AST-2017-005.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://downloads.asterisk.org/pub/security/AST-2017-006.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/jessie/asterisk"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://packages.debian.org/source/stretch/asterisk"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2017/dsa-3964"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the asterisk packages.
    
    For the oldstable distribution (jessie), these problems have been
    fixed in version 1:11.13.1~dfsg-2+deb8u3.
    
    For the stable distribution (stretch), these problems have been fixed
    in version 1:13.14.1~dfsg-2+deb9u1."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:asterisk");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:8.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2017/09/04");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/09/05");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"8.0", prefix:"asterisk", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-config", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-dahdi", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-dbg", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-dev", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-doc", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-mobile", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-modules", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-mp3", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-mysql", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-ooh323", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-voicemail", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-voicemail-imapstorage", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-voicemail-odbcstorage", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"8.0", prefix:"asterisk-vpb", reference:"1:11.13.1~dfsg-2+deb8u3")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-config", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-dahdi", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-dev", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-doc", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-mobile", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-modules", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-mp3", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-mysql", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-ooh323", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-voicemail", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-voicemail-imapstorage", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-voicemail-odbcstorage", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    if (deb_check(release:"9.0", prefix:"asterisk-vpb", reference:"1:13.14.1~dfsg-2+deb9u1")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMisc.
    NASL idASTERISK_AST_2017_008.NASL
    descriptionAccording to its SIP banner, the version of Asterisk running on the remote host is 11.x prior to 11.25.3, 13.x prior to 13.17.2, 14.x prior to 14.6.2, 11.6 prior to 11.6-cert18, or 13.13 prior to 13.13-cert6. It is therefore, affected by an information disclosure vulnerability due to insufficient RTCP packet validation. A remote attacker could potentially read buffer contents and redirect where the next RTCP report goes. Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id104042
    published2017-10-20
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104042
    titleAsterisk 11.x < 11.25.3 / 13.x < 13.17.2 / 14.x < 14.6.2 / 11.6 < 11.6-cert18 / 13.13 < 13.13-cert6 RTP/RTCP information leak (AST-2017-008)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(104042);
      script_version("1.6");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id("CVE-2017-14099", "CVE-2017-14603");
      script_bugtraq_id(100669, 101237);
    
      script_name(english:"Asterisk 11.x < 11.25.3 / 13.x < 13.17.2 / 14.x < 14.6.2 / 11.6 < 11.6-cert18 / 13.13 < 13.13-cert6 RTP/RTCP information leak (AST-2017-008)");
      script_summary(english:"Checks the version in the SIP banner.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A telephony application running on the remote host is affected by 
    an information disclosure vulnerability.");
      script_set_attribute(attribute:"description", value:
    "According to its SIP banner, the version of Asterisk running on the
    remote host is 11.x prior to 11.25.3, 13.x prior to 13.17.2,
    14.x prior to 14.6.2, 11.6 prior to 11.6-cert18, or 13.13 prior to
    13.13-cert6. It is therefore, affected by an information disclosure
    vulnerability due to insufficient RTCP packet validation. A remote
    attacker could potentially read buffer contents and redirect where
    the next RTCP report goes.
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"http://downloads.asterisk.org/pub/security/AST-2017-008.html");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to Asterisk version 11.25.3 / 13.17.2 / 14.6.2 / 11.6-cert18 / 13.13-cert6 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-14603");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/05/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/09/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/10/20");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:digium:asterisk");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Misc.");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("asterisk_detection.nasl");
      script_require_keys("asterisk/sip_detected", "Settings/ParanoidReport");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("asterisk/sip_detected");
    
    asterisk_kbs = get_kb_list_or_exit("sip/asterisk/*/version");
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    is_vuln = FALSE;
    not_vuln_installs = make_list();
    errors = make_list();
    
    foreach kb_name (keys(asterisk_kbs))
    {
      vulnerable = 0;
    
      matches = pregmatch(pattern:"/(udp|tcp)/([0-9]+)/version", string:kb_name);
      if (isnull(matches))
      {
        errors = make_list(errors, "Unexpected error parsing port number from '"+kb_name+"'.");
        continue;
      }
    
      proto = matches[1];
      port  = matches[2];
      version = asterisk_kbs[kb_name];
    
      if (version == 'unknown')
      {
        errors = make_list(errors, "Unable to obtain version of installation on " + proto + "/" + port + ".");
        continue;
      }
    
      banner = get_kb_item("sip/asterisk/" + proto + "/" + port + "/source");
      if (!banner)
      {
        # We have version but banner is missing;
        # log error and use in version-check though.
        errors = make_list(errors, "KB item 'sip/asterisk/" + proto + "/" + port + "/source' is missing.");
        banner = 'unknown';
      }
    
      if (version =~ "^11([^0-9])" && "cert" >!< tolower(version))
      {
        fixed = "11.25.3";
        vulnerable = ver_compare(ver:version, fix:fixed, app:"asterisk");
      }
      else if (version =~ "^13([^0-9])" && "cert" >!< tolower(version))
      {
        fixed = "13.17.2";
        vulnerable = ver_compare(ver:version, fix:fixed, app:"asterisk");
      }
      else if (version =~ "^14([^0-9])" && "cert" >!< tolower(version))
      {
        fixed = "14.6.2";
        vulnerable = ver_compare(ver:version, fix:fixed, app:"asterisk");
      }
      else if (version =~ "^11\.6([^0-9])" && "cert" >< tolower(version))
      {
        fixed = "11.6-cert18";
        vulnerable = ver_compare(ver:version, fix:fixed, app:"asterisk");
      }
      else if (version =~ "^13\.13([^0-9])" && "cert" >< tolower(version))
      {
        fixed = "13.13-cert6";
        vulnerable = ver_compare(ver:version, fix:fixed, app:"asterisk");
      }
    
      if (vulnerable < 0)
      {
        is_vuln = TRUE;
        report =
            '\n  Version source    : ' + banner +
            '\n  Installed version : ' + version +
            '\n  Fixed version     : ' + fixed +
            '\n';
          security_report_v4(severity:SECURITY_WARNING, port:port, proto:proto, extra:report);
      }
      else not_vuln_installs = make_list(not_vuln_installs, version + " on port " + proto + "/" + port);
    }
    
    if (max_index(errors))
    {
      if (max_index(errors) == 1) errmsg = errors[0];
      else errmsg = 'Errors were encountered verifying installations : \n  ' + join(errors, sep:'\n  ');
    
      exit(1, errmsg);
    }
    else
    {
      installs = max_index(not_vuln_installs);
      if (installs == 0)
      {
        if (is_vuln) exit(0);
        else audit(AUDIT_NOT_INST, "Asterisk");
      }
      else audit(AUDIT_INST_VER_NOT_VULN, "Asterisk", not_vuln_installs);
    }
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201710-29.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201710-29 (Asterisk: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Asterisk. Please review the referenced CVE identifiers for details. Impact : A remote attacker could execute arbitrary code, cause a denial of service condition, or cause an unauthorized data disclosure by enticing a user to run malicious code. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id104230
    published2017-10-30
    reporterThis script is Copyright (C) 2017-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/104230
    titleGLSA-201710-29 : Asterisk: Multiple vulnerabilities
  • NASL familyMisc.
    NASL idASTERISK_AST_2017_005-007.NASL
    descriptionAccording to its SIP banner, the version of Asterisk running on the remote host is 11.x prior to 11.25.2, 13.x prior to 13.17.1, 14.x prior to 14.6.1, 11.6 prior to 11.6-cert17, or 13.13 prior to 13.13-cert5. It is therefore, affected by multiple vulnerabilities as described in AST-2017-005, AST-2017-006, and AST-2017-007. Note for AST-2017-005, only 11.4.0 is affected in the 11.x branch. Also note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id102958
    published2017-09-05
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102958
    titleAsterisk 11.x < 11.25.2 / 11.6 < 11.6-cert17 / 13.x < 13.17.1 / 14.x < 14.6.1 / 13.13 < 13.13-cert5 Multiple Vulnerabilities (AST-2017-005 - AST-2017-007)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_C599F95C8EE511E78BE8001999F8D30B.NASL
    descriptionThe Asterisk project reports : AST-2017-005 - A change was made to the strict RTP support in the RTP stack to better tolerate late media when a reinvite occurs. When combined with the symmetric RTP support this introduced an avenue where media could be hijacked. Instead of only learning a new address when expected the new code allowed a new source address to be learned at all times. AST-2017-006 - The app_minivm module has an
    last seen2020-06-01
    modified2020-06-02
    plugin id102940
    published2017-09-05
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/102940
    titleFreeBSD : asterisk -- Unauthorized data disclosure and shell access command injection in app_minivm (c599f95c-8ee5-11e7-8be8-001999f8d30b)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_C2EA3B319D7511E7BB13001999F8D30B.NASL
    descriptionThe Asterisk project reports : This is a follow up advisory to AST-2017-005. Insufficient RTCP packet validation could allow reading stale buffer contents and when combined with the
    last seen2020-06-01
    modified2020-06-02
    plugin id103346
    published2017-09-20
    reporterThis script is Copyright (C) 2017-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/103346
    titleFreeBSD : asterisk -- RTP/RTCP information leak (c2ea3b31-9d75-11e7-bb13-001999f8d30b)