Bug#947381: asterisk: CVE-2019-18790: AST-2019-006: SIP request can change address of a SIP peer

[Salvatore Bonaccorso]

Source: asterisk
Version: 1:16.2.1~dfsg-2
Severity: important
Tags: security upstream
Forwarded: https://issues.asterisk.org/jira/browse/ASTERISK-28589
Control: found -1 1:16.2.1~dfsg-1+deb10u1
Control: found -1 1:16.2.1~dfsg-1
Control: found -1 1:13.14.1~dfsg-2+deb9u4
Control: found -1 1:13.14.1~dfsg-1

Hi,

The following vulnerability was published for asterisk.

CVE-2019-18790[0]:
| An issue was discovered in channels/chan_sip.c in Sangoma Asterisk
| 13.x, 16.x, and 17.x, and Certified Asterisk 13.21, because of an
| incomplete fix for CVE-2019-18351. A SIP request can be sent to
| Asterisk that can change a SIP peer's IP address. A REGISTER does not
| need to occur, and calls can be hijacked as a result. The only thing
| that needs to be known is the peer's name; authentication details such
| as passwords do not need to be known. This vulnerability is only
| exploitable when the nat option is set to the default, or
| auto_force_rport.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2019-18790
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18790
[1] https://issues.asterisk.org/jira/browse/ASTERISK-28589

Please adjust the affected versions in the BTS as needed.



-- System Information:
Debian Release: bullseye/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.3.0-3-amd64 (SMP w/2 CPU cores)
Kernel taint flags: TAINT_WARN
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled