AST-2017-014: Crash In PJSIP Resource When Missing A Contact Header

Home » Asterisk Users » AST-2017-014: Crash In PJSIP Resource When Missing A Contact Header
Asterisk Users No Comments

Asterisk Project Security Advisory – AST-2017-014

Product Asterisk
Summary Crash in PJSIP resource when missing a contact
Nature of Advisory Remote Crash
Susceptibility Remote Unauthenticated Sessions
Severity Moderate
Exploits Known No
Reported On December 12, 2017
Reported By Ross Beer
Posted On
Last Updated On December 22, 2017
Advisory Contact Kevin Harwell
CVE Name

Description A select set of SIP messages create a dialog in Asterisk.
Those SIP messages must contain a contact header. For those
messages, if the header was not present and using the PJSIP
channel driver, it would cause Asterisk to crash. The
severity of this vulnerability is somewhat mitigated if
authentication is enabled. If authentication is enabled a
user would have to first be authorized before reaching the
crash point.

Resolution When using the Asterisk PJSIP resource, and one of the SIP
messages that create a dialog is received Asterisk now
checks to see if the message contains a contact header. If
it does not Asterisk now responds with a “400 Missing
Contact header”.

Affected Versions
Product Release
Asterisk Open Source 13.x All versions
Asterisk Open Source 14.x All versions
Asterisk Open Source 15.x All versions
Certified Asterisk 13.18 All versions

Corrected In
Product Release
Asterisk Open Source 13.18.5, 14.7.5, 15.1.5
Certified Asterisk 13.18-cert2

SVN URL Revision Asterisk
13 Asterisk
14 Asterisk
15 Certified


Asterisk Project Security Advisories are posted at

This document may be superseded by later versions; if so, the latest
version will be posted at and

Revision History
Date Editor Revisions Made
December 20, 2017 Kevin Harwell Initial Revision

Asterisk Project Security Advisory – AST-2017-014
Copyright (c) 2017 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.