CVE-2016-9938

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2016-9938

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-9938.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2016-9938

Related

UBUNTU-CVE-2016-9938

Published

2016-12-12T21:59:01Z

Modified

2025-01-08T04:32:36.592310Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chansip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable ASCII character as if it were whitespace. This means that headers such as Contact\x01: will be seen as a valid Contact header. This mostly does not pose a problem until Asterisk is placed in tandem with an authenticating SIP proxy. In such a case, a crafty combination of valid and invalid To headers can cause a proxy to allow an INVITE request into Asterisk without authentication since it believes the request is an in-dialog request. However, because of the bug described above, the request will look like an out-of-dialog request to Asterisk. Asterisk will then process the request as a new call. The result is that Asterisk can process calls from unvetted sources without any authentication. If you do not use a proxy for authentication, then this issue does not affect you. If your proxy is dialog-aware (meaning that the proxy keeps track of what dialogs are currently valid), then this issue does not affect you. If you use chanpjsip instead of chan_sip, then this issue does not affect you.

References

Affected packages

Debian:11 / asterisk

Package

Name: asterisk
Purl: pkg:deb/debian/asterisk?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:13.13.1~dfsg-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/asterisk/asterisk

Affected ranges

Type: GIT
Repo: https://github.com/asterisk/asterisk
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

06f5ace1fa80ce0799c6d25954de2236a1f842c8

Last affected

106c33d20fe0709159a6c57c970cc95a98bfba9f

Last affected

1108a7f521143c8afd10e24c3f3582b5798da58d

Last affected

11532619390066c7ad3ece378c8b3b34fedeffed

Last affected

11b0fb111b11aeaf3aaeed62601c42ca5a5b68bc

Last affected

146b4b8e8b6e94794606aa4877dbebd6257c532e

Last affected

155bff138212257ca6ed34a824a5dfe3ed830830

Last affected

1639644ba71c01a03ceec06da8899b9dad62818c

Last affected

19533f3faeb345568d2aea9bbc7fd841f962e815

Last affected

19e035d2e83cb68a25fe319c9e06dcb3f3b2da87

Last affected

19fb526344f10be789d52b2c444d13a2a0ba0a8b

Last affected

1a9331e814407d43a2e46e24825a6eedc7f2805f

Last affected

211d2836de28a51a91c1cb27f1ab16eba05c9b51

Last affected

226a7e36c538de73cee76de4183b1569bd5501e5

Last affected

249bb3e7296bbef2daaf889f74807ef6cac407d6

Last affected

27a592b8e77ed5735c586d7230125dbe3d52e595

Last affected

294da68ab62b662940fb623affa6ea3b03be338e

Last affected

2a4ed773339cab64713c8f372b29e20cba298ca4

Last affected

2b87c28313b36f4a8f85dad8af04aad03117e139

Last affected

2db4f6c01283e7491c3ee3b7507e59e5367df0ea

Last affected

2f573737b0360acc150110f11c6038bf072f1d30

Last affected

2f9a1a6d749f5518dc64ef4b043abb27f263d290

Last affected

2fd9440b5809e4a1a8b075867c902bd6a9965e13

Last affected

3024b4b97ae6522c9bf0c2e4501a28b4ee4ad87c

Last affected

3585f89d44655687c55176e74bae4c0b5b5e77db

Last affected

35d74f5d4e15903c66abe602432df9e04049edb5

Last affected

37cde9225d9526e465698b958a6720d8e33709be

Last affected

3a13663e70831c88186fb8663be25542d7f41625

Last affected

3b1c3e8283ebc2d1f5f241e042a828ed43cc9731

Last affected

3c4b64351bc44b26fdfbb9101501ad8e485c9e11

Last affected

3cdb24a93c34a9cc94542b81f609ad7a2f6b66fd

Last affected

3f2411a18dd2c71225a706af2fed6e2e719da727

Last affected

4205e661092e4e469a5e6f50f860202032bef2c3

Last affected

45e0392397605b8c8d0d975c63e21dd7b2c951de

Last affected

55dc6620c26c0030b7e77a71f0f10919c0b3188b

Last affected

56487be6d9d0f9fbb0d46c97c7f84b1c0a0ec34c

Last affected

5a25b825276c8df42d7d10579957f26d3c777fbf

Last affected

5b447785b61a68b24c2c1672f19659476e9b9804

Last affected

5cc6bd8fe6a4ee99ecb05178e30ca35e07ba8e4f

Last affected

5d80d3863404fcd03fdd965f96cf699eee98e402

Last affected

614fc2b6ee64a966c67e11cf04c605afde7b2e30

Last affected

61a50ebecf19f7ca9305a10fb1a2490d76f44550

Last affected

658f72cb71d8b5d4063e1ec70588cd55a4c52bc2

Last affected

6802552203878e1c33e1812ad60a68db30d2fa24

Last affected

6d5056218533f43cc93dc4b8a75d22257d12ad7d

Last affected

6e27c017c73d2eaf74631d93dfb8aaf756a517ac

Last affected

7032890c9e21d69a628b40612aa3d86147c542d9

Last affected

705735bb2bc117daa538de446da513beff02c5b8

Last affected

707e464f2e224569482df25499507f98b4f1bfe2

Last affected

7430e196d12454544c183259ed442fc1cab8dc70

Last affected

7d181f2b3daac4c1f5a215470946b81495203730

Last affected

7d7b52c434eb23ef470ad51d08ee4029a7078b78

Last affected

7f636d8a57264f21be9b8f546036f0acf5d3c62d

Last affected

82e513d699311c1e5b1b96639147da2b9a4441e8

Last affected

85335355efb2d7914a1fe20ed31afcef15fd210c

Last affected

85b0adbc8a329b2f19649f0712d85e1f8c0eba01

Last affected

8651a6e3dadf4e2b071abb4257f71f8f23f18597

Last affected

8685f96aaa8a98f4ef437bdc430d7f59ce7b53d0

Last affected

8b8d8a305b8579c4b89aad9ddd9449fcf849f130

Last affected

8ed31147ca2cac0efe354faa75249bf08b362af7

Last affected

8fe7e4679a9caf62d4e86419d2746d0feb56270c

Last affected

930bd0a821e3271f4aa39bef9f961ac51e358871

Last affected

933356d01000d7554810d34457a86e6d629fb026

Last affected

93fdd80012ed2ede44844f458136970020e7f718

Last affected

9528429f4c9d58516525224b24ff566e189c1398

Last affected

968f188ccf2eebe6834afa4411a382ad4e5b95e4

Last affected

97a081e71419f1b5fbe721302db55d459be82ce3

Last affected

9b2f204e352d6164f9d6e1f6b28c8fee0065f12e

Last affected

9c8364895b536fb7a8ded593400b08c83215f15e

Last affected

9c97e9464e57a8dfda435fed0d0cd0b65d468ba7

Last affected

9eb27e03314eb37c3dd9fc9be63b85651346f70f

Last affected

9f52e16c269a3c18d9f50f92c4553e8e6d72e838

Last affected

a06b72ee1e806d783e1a9af1ab61e544278be55a

Last affected

a0b9ab019832207882dfb1c6ace1f8c920074ce9

Last affected

a3681b2826cdbcfa1c591d6c91b839578161bfd1

Last affected

a6ac89c740a9a8e9ee0e008e12df3998ea6a2492

Last affected

a92aa59c1df5092ad92b7fd1641841bf31f063fb

Last affected

ac0f73694b59317f776ea2f4b8f777327def154e

Last affected

adf51fff8f5264aae1ea6cbe7cb90ffdd5dd28af

Last affected

affbc6907eb544bc6e049085de91002ca24ff930

Last affected

b40583a6e7b4bcc930cd0dd7954336bfdee879d3

Last affected

b46f5d3a78c07730a95f6fa87a2d09b7fe2cebea

Last affected

b633f5ac9497824f5bdd67657a04c94aabc88e0c

Last affected

b8336252bed3de5a7d0da8a2bfc98f6547cdfb6d

Last affected

bbe6d18471f4a2dee52959a462163f3ac6b20b32

Last affected

bda53c1fe8bc378c64142da595f95605335ea281

Last affected

bf004c4584649d080979c4f877a6e9d3e793467c

Last affected

c0e30d6457a080e43665dbe60226e6437db9f004

Last affected

c13803f4b48e107e318bd652ae9ce84b6d264c81

Last affected

c30613f7923ddb339dd30b9e1ce7cb18d15f75dc

Last affected

c41eb44de9da1614b86fe3b5d0bf535c17e2e656

Last affected

c6d6dd133c3db3b202f1f0d457780c9a6d841e0f

Last affected

c8107eefe9ea1f336fc0eafc0a215381a568f087

Last affected

caaf2326d01b555d652b821f6cf0412746055fd7

Last affected

cb5d32bd705344af7241d1769b12d2e3b62da56e

Last affected

cc1106a06ac487e54c8222f30b6cc477d90986e1

Last affected

ceb4fdd341abc0e7e06a7d58767cc082dadbd32c

Last affected

d2cd4e58d8bb442bc13d3bd10879d3565fc78ab2

Last affected

d6560cf707793d6945dbb4fae08e242edcee0efb

Last affected

d880cb4af7ec79941688bf7a93e710321b618795

Last affected

d95f2fd9793806d400155a97e4d15bf0f33d08f9

Last affected

dabf482ce43ef37f4cef7a85e7971382b506f5c8

Last affected

de9145e0febe6e2c83628821f4906acd89c39515

Last affected

df5493573af6efba1fb8ec7f852e85b611eb2fcc

Last affected

e14cc5edb2176fc0e8153daf27d74b958f93e639

Last affected

e1736c6dd59d0ce46f51432c9c18de7ac5f78241

Last affected

e2453cf2d10c7f659f6567a6fd0a01420e82b92e

Last affected

e343034f6681afff6a0d070c30dbd8c81914f9bc

Last affected

e3b1f2dfd87b098b22829ddba204a3d19c38306a

Last affected

e5a3b1d0e751e1d9799dfeddb31d3091b31a6e96

Last affected

e70b66157732cfba5e2c94030f2666030851335c

Last affected

e7305c01f21a8e935e449e19652f96a582bd76dd

Last affected

e82920118708cac3f1375341a7522f4e12b0c0e2

Last affected

eaaf1789b031583a77b377c425b4870694e7ef69

Last affected

ec0088f7fb1d4bc744657403d2607a1ae9547c27

Last affected

ee73af1d88c9ff6db90f70f934f5ea57b8ab0625

Last affected

ee7aa21e683f0b46705effb0cf9a8e0af59b0160

Last affected

f1bfc6169ba6d6a74fcbe38b57cfd9e5607caec3

Last affected

f3a578ce98f33b7302fca71066e96ab581aa5167

Last affected

f6ad2915b308e4132df613dce59d994656f7b7a8

Last affected

f6f483170c44642fa0267c96e6a40d8691f32d34

Last affected

f8d503582c3506e2a65e1ec96b4f2c0833623666

Last affected

f8fb5a74b32637bd700117d65f0b53d522e1b85d

Last affected

fad0410486b3a47743331f14fcb565b79357887c

Last affected

fbdaade2645d954d9bd0191dd60a218acfa93ba1

Last affected

fdde690e0fa2e58bf45ea2bf83962bb1c261d6e0

Last affected

fea3b67d432b51a8d8cd5bd544acee6f66d9b25c

Last affected

ff4dbeaf3894d28de5c9e2a718702442acddcb29

Affected versions

11.*

11.2.0-rc1

11.2.0-rc2

11.6.0

11.6.0-rc1

11.6.0-rc2

13.*

13.1.0

13.1.0-rc1

13.1.0-rc2

13.12.0

13.12.0-rc1

13.13.0

13.13.0-rc1

13.13.0-rc2

13.8.0-rc1

certified/11.*

certified/11.6-cert12

certified/11.6-cert13

certified/11.6-cert14

certified/11.6-cert14-rc1

certified/11.6-cert14-rc2