CVE-2018-19278

Published: Nov 14, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed length.

Affected (30)

Products: Digium: Asterisk

Digium

1 product

Asterisk

Configuration A

30 vulnerable

Vulnerable Software	Affected Versions
Digium Asterisk	Version 15.0.0
Digium Asterisk	Version 15.0.0 b1
Digium Asterisk	Version 15.0.0 rc1
Digium Asterisk	Version 15.1.0
Digium Asterisk	Version 15.1.0 rc1
Digium Asterisk	Version 15.1.0 rc2
Digium Asterisk	Version 15.1.2
Digium Asterisk	Version 15.1.3
Digium Asterisk	Version 15.1.4
Digium Asterisk	Version 15.1.5
Digium Asterisk	Version 15.2.0 rc1
Digium Asterisk	Version 15.2.0 rc2
Digium Asterisk	Version 15.2.1
Digium Asterisk	Version 15.2.2
Digium Asterisk	Version 15.3.0
Digium Asterisk	Version 15.3.0 rc1
Digium Asterisk	Version 15.3.0 rc2
Digium Asterisk	Version 15.4.0
Digium Asterisk	Version 15.4.0 rc1
Digium Asterisk	Version 15.4.0 rc2
Digium Asterisk	Version 15.4.1
Digium Asterisk	Version 15.5.0
Digium Asterisk	Version 15.5.0 rc1
Digium Asterisk	Version 15.6.0
Digium Asterisk	Version 15.6.0 rc1
Digium Asterisk	Version 15.6.1
Digium Asterisk	Version 16.0.0
Digium Asterisk	Version 16.0.0 rc2
Digium Asterisk	Version 16.0.0 rc3
Digium Asterisk	Version 16.0.1 rc1