[Secure-testing-team] Bug#885072: asterisk: CVE-2017-17850: Crash in PJSIP resource when missing a contact header

[Salvatore Bonaccorso]

Source: asterisk
Version: 1:13.18.3~dfsg-1
Severity: grave
Tags: patch security upstream
Forwarded: https://issues.asterisk.org/jira/browse/ASTERISK-27480 

Hi,

the following vulnerability was published for asterisk.

CVE-2017-17850[0]:
| An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and
| older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP
| messages create a dialog in Asterisk. Those SIP messages must contain a
| contact header. For those messages, if the header was not present and
| the PJSIP channel driver was used, Asterisk would crash. The severity
| of this vulnerability is somewhat mitigated if authentication is
| enabled. If authentication is enabled, a user would have to first be
| authorized before reaching the crash point.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-17850
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17850
[1] https://issues.asterisk.org/jira/browse/ASTERISK-27480
[2] http://downloads.asterisk.org/pub/security/AST-2017-014.html

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore