FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

asterisk -- Remote crash possible when negotiating T.38

Affected packages
16.15.0 <= asterisk16 < 16.16.1
18.1.0 <= asterisk18 < 18.2.1

Details

VuXML ID e3894955-7227-11eb-8386-001999f8d30b
Discovery 2021-02-05
Entry 2021-02-18

The Asterisk project reports:

When re-negotiating for T.38 if the initial remote response was delayed just enough Asterisk would send both audio and T.38 in the SDP. If this happened, and the remote responded with a declined T.38 stream then Asterisk would crash.

[source]

References

CVE Name CVE-2021-26717
URL https://downloads.asterisk.org/pub/security/AST-2021-002.html

Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright information.