Asterisk 13.29.2, 16.6.2, 17.0.1 And 13.21-cert5 Now Available (Security)

Home » Asterisk Users » Asterisk 13.29.2, 16.6.2, 17.0.1 And 13.21-cert5 Now Available (Security)
Asterisk Users No Comments

The Asterisk Development Team would like to announce security releases for Asterisk 13, 16 and 17, and Certified Asterisk 13.21. The available releases are released as versions 13.29.2, 16.6.2, 17.0.1 and 13.21-cert5.

These releases are available for immediate download at

https://downloads.asterisk.org/pub/telephony/asterisk/releases https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

* AST-2019-006: SIP request can change address of a SIP peer.
A SIP request can be sent to Asterisk that can change a SIP peer’s IP
address. A REGISTER does not need to occur, and calls can be hijacked as a
result. The only thing that needs to be known is the peer’s name;
authentication details such as passwords do not need to be known. This
vulnerability is only exploitable when the “nat” option is set to the
default, or “auto_force_rport”.

* AST-2019-007: AMI user could execute system commands.
A remote authenticated Asterisk Manager Interface (AMI) user without
“system” authorization could use a specially crafted “Originate” AMI
request to execute arbitrary system commands.

* AST-2019-008: Re-invite with T.38 and malformed SDP causes crash.
If Asterisk receives a re-invite initiating T.38 faxing and has a port of 0
and no c line in the SDP, a crash will occur.

For a full list of changes in the current releases, please see the ChangeLogs:

https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-13.29.2
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-16.6.2
https://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-17.0.1
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases/ChangeLog-certified-13.21-cert5

The security advisories are available at:

https://downloads.asterisk.org/pub/security/AST-2019-006.pdf https://downloads.asterisk.org/pub/security/AST-2019-007.pdf https://downloads.asterisk.org/pub/security/AST-2019-008.pdf

Thank you for your continued support of Asterisk!