Asterisk: Possible RED T.140 Heap Buffer Overflow

Overview

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a T.140 RED heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The chan_sip channel driver must be installed and configured, and its textsupport option must be enabled; textsupport defaults to no. The chan_sip driver was deprecated in Asterisk 20 and completely removed in all later versions. Repository comparisons verify patch containment in Asterisk 20.20.1, 21.12.3, 22.10.1 and 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3. The affected release-track scope remains unresolved: structured metadata includes later release tracks even though the advisory says the required chan_sip driver was removed there.

Affected

• asterisk < 20.20.1
• asterisk >= 21.0.0-pre1, < 21.12.3
• asterisk >= 22.0.0-pre1, < 22.10.1
• asterisk >= 23.0.0-pre1, < 23.4.1
• certified-asterisk < 20.7-cert11
• certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.