Asterisk Project Security Advisory – AST-2016-005

Product Asterisk
Summary TCP denial of service in PJProject
Nature of Advisory Crash/Denial of Service
Susceptibility Remote Unauthenticated Sessions
Severity Critical
Exploits Known No
Reported On February 15, 2016
Reported By George Joseph
Posted On
Last Updated On March 3, 2016
Advisory Contact Mark Michelson
CVE Name

Description PJProject has a limit on the number of TCP connections that
it can accept. Furthermore, PJProject does not close TCP
connections it accepts. By default, this value is
approximately 60.

An attacker can deplete the number of allowed TCP
connections by opening TCP connections and sending no data
to Asterisk.

If PJProject has been compiled in debug mode, then once the
number of allowed TCP connections has been depleted, the
next attempted TCP connection to Asterisk will crash due to
an assertion in PJProject.

If PJProject has not been compiled in debug mode, then any
further TCP connection attempts will be rejected. This
makes Asterisk unable to process TCP SIP traffic.

Note that this only affects TCP/TLS, since UDP is
connectionless. Also note that this does not affect
chan_sip.

Resolution PJProject has a compile-time constant that controls the
maximum number of TCP connections that can be handled. Those
who compile PJProject on their own are encouraged to set
this to a value that is more amenable to the number of TCP
connections that Asterisk should be able to handle. In
PJProject’s pjlib/include/pj/config_site.h, add the
following prior to compiling PJProject:

# define PJ_IOQUEUE_MAX_HANDLES (FD_SETSIZE)

This is part of a larger set of recommended definitions to
place in config_site.h of PJProject. See the Asterisk
“Building and Installing PJProject” wiki page for other
recommended settings.

Packagers of PJProject have updated their packages to have
these constants defined, so if your package is kept up to
date, you should already be fine.

In addition, the Asterisk project has recently been modified
to be able to perform a static build of PJProject. By
running the Asterisk configure script with the
–with-pjproject-bundled option, the latest PJProject will
be downloaded and installed, and the compile-time constants
will be set to appropriate values.

Asterisk has also been updated to monitor incoming TCP
connections. If a TCP connection is opened and no SIP
request is received on that connection within a certain
amount of time, then Asterisk will shut down the connection.

Affected Versions
Product Release
Series
Asterisk Open Source 13.x All Versions

Corrected In
Product Release
Asterisk Open Source 13.8.1
Certified Asterisk 13.1-cert5

Patches
SVN URL Revision

Links

Asterisk Project Security Advisories are posted at
http://www.asterisk.org/security

This document may be superseded by later versions; if so, the latest
version will be posted at
http://downloads.digium.com/pub/security/AST-2016-005.pdf and
http://downloads.digium.com/pub/security/AST-2016-005.html

Revision History
Date Editor Revisions Made

Asterisk Project Security Advisory – AST-2016-005
Copyright (c) 2016 Digium, Inc. All Rights Reserved.
Permission is hereby granted to distribute and publish this advisory in its
original, unaltered form.