UBUNTU-CVE-2019-18790

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2019-18790
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-18790.json
JSON Data
https://api.test.osv.dev/v1/vulns/UBUNTU-CVE-2019-18790
Upstream
Published
2019-11-22T17:15:00Z
Modified
2025-10-24T04:47:57Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

An issue was discovered in channels/chansip.c in Sangoma Asterisk 13.x before 13.29.2, 16.x before 16.6.2, and 17.x before 17.0.1, and Certified Asterisk 13.21 before cert5. A SIP request can be sent to Asterisk that can change a SIP peer's IP address. A REGISTER does not need to occur, and calls can be hijacked as a result. The only thing that needs to be known is the peer's name; authentication details such as passwords do not need to be known. This vulnerability is only exploitable when the nat option is set to the default, or autoforce_rport.

References

Affected packages

Ubuntu:Pro:16.04:LTS / asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk@1:13.1.0~dfsg-1.1ubuntu4.1+esm1?arch=source&distro=esm-apps/xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:13.*

1:13.1.0~dfsg-1.1ubuntu3
1:13.1.0~dfsg-1.1ubuntu4
1:13.1.0~dfsg-1.1ubuntu4.1
1:13.1.0~dfsg-1.1ubuntu4.1+esm1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "asterisk",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-config",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-dahdi",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-dev",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-mobile",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-modules",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-mp3",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-mysql",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-ooh323",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-voicemail",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-voicemail-imapstorage",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-voicemail-odbcstorage",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        },
        {
            "binary_name": "asterisk-vpb",
            "binary_version": "1:13.1.0~dfsg-1.1ubuntu4.1+esm1"
        }
    ]
}

Ubuntu:18.04:LTS / asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk@1:13.18.3~dfsg-1ubuntu4?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:13.*

1:13.17.2~dfsg-1ubuntu1
1:13.17.2~dfsg-2ubuntu1
1:13.18.1~dfsg-1ubuntu1
1:13.18.3~dfsg-1ubuntu1
1:13.18.3~dfsg-1ubuntu2
1:13.18.3~dfsg-1ubuntu3
1:13.18.3~dfsg-1ubuntu4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "asterisk",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-config",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-dahdi",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-dev",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-mobile",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-modules",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-mp3",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-mysql",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-ooh323",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-tests",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-voicemail",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-voicemail-imapstorage",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-voicemail-odbcstorage",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        },
        {
            "binary_name": "asterisk-vpb",
            "binary_version": "1:13.18.3~dfsg-1ubuntu4"
        }
    ]
}

Ubuntu:20.04:LTS / asterisk

Package

Name
asterisk
Purl
pkg:deb/ubuntu/asterisk@1:16.2.1~dfsg-2ubuntu1?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

1:16.*

1:16.2.1~dfsg-2build2
1:16.2.1~dfsg-2build3
1:16.2.1~dfsg-2ubuntu1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "asterisk",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-config",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-dahdi",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-dev",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-mobile",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-modules",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-mp3",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-mysql",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-ooh323",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-tests",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-voicemail",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-voicemail-imapstorage",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-voicemail-odbcstorage",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        },
        {
            "binary_name": "asterisk-vpb",
            "binary_version": "1:16.2.1~dfsg-2ubuntu1"
        }
    ]
}