Asterisk: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk

Overview

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in chan_unistim DIALPAGE digit handling can overflow the phone_number field and crash Asterisk when an attacker sends a carefully crafted incoming request packet. The chan_unistim module must be loaded and configured with a valid UNISTIM UDP port that the attacker can reach. The attacker must register as a configured phone MAC, or the deployment must have an equivalent production/autoprovisioning path that allows the client to reach the main page. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected

• asterisk < 20.20.1
• asterisk >= 21.0.0-pre1, < 21.12.3
• asterisk >= 22.0.0-pre1, < 22.10.1
• asterisk >= 23.0.0-pre1, < 23.4.1
• certified-asterisk < 20.7-cert11
• certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.