Lucene search

DebianDEBIAN:DLA-2017-1:61417

HistoryNov 30, 2019 - 8:56 p.m.

[SECURITY] [DLA 2017-1] asterisk security update

2019-11-3020:56:56

lists.debian.org

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7 High

AI Score

Confidence

High

0.779 High

EPSS

Percentile

98.3%

JSON

Package : asterisk
Version : 1:11.13.1~dfsg-2+deb8u7
CVE ID : CVE-2019-13161 CVE-2019-18610 CVE-2019-18790

Several vulnerabilites are fixed in Asterisk,
an Open Source PBX and telephony toolkit.

CVE-2019-13161
An attacker was able to crash Asterisk when handling an SDP answer to an
outgoing T.38 re-invite.

CVE-2019-18610
Remote authenticated Asterisk Manager Interface (AMI) users without
system authorization could execute arbitrary system commands.

CVE-2019-18790
A SIP call hijacking vulnerability.

For Debian 8 "Jessie", these problems have been fixed in version
1:11.13.1~dfsg-2+deb8u7.

We recommend that you upgrade your asterisk packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian9amd64asterisk< 1:13.14.1~dfsg-2+deb9u6asterisk_1:13.14.1~dfsg-2+deb9u6_amd64.deb
Debian9armelasterisk-mysql< 1:13.14.1~dfsg-2+deb9u6asterisk-mysql_1:13.14.1~dfsg-2+deb9u6_armel.deb
Debian10amd64asterisk-ooh323-dbgsym< 1:16.2.1~dfsg-1+deb10u2asterisk-ooh323-dbgsym_1:16.2.1~dfsg-1+deb10u2_amd64.deb
Debian10s390xasterisk-voicemail-odbcstorage-dbgsym< 1:16.2.1~dfsg-1+deb10u2asterisk-voicemail-odbcstorage-dbgsym_1:16.2.1~dfsg-1+deb10u2_s390x.deb
Debian9amd64asterisk-mp3< 1:13.14.1~dfsg-2+deb9u6asterisk-mp3_1:13.14.1~dfsg-2+deb9u6_amd64.deb
Debian10arm64asterisk-dahdi-dbgsym< 1:16.2.1~dfsg-1+deb10u2asterisk-dahdi-dbgsym_1:16.2.1~dfsg-1+deb10u2_arm64.deb
Debian8armhfasterisk-dahdi< 1:11.13.1~dfsg-2+deb8u7asterisk-dahdi_1:11.13.1~dfsg-2+deb8u7_armhf.deb
Debian8amd64asterisk-ooh323< 1:11.13.1~dfsg-2+deb8u7asterisk-ooh323_1:11.13.1~dfsg-2+deb8u7_amd64.deb
Debian10arm64asterisk-tests-dbgsym< 1:16.2.1~dfsg-1+deb10u2asterisk-tests-dbgsym_1:16.2.1~dfsg-1+deb10u2_arm64.deb
Debian9i386asterisk-voicemail-imapstorage< 1:13.14.1~dfsg-2+deb9u6asterisk-voicemail-imapstorage_1:13.14.1~dfsg-2+deb9u6_i386.deb

OS	Version	Architecture	Package	Version	Filename
Debian	9	amd64	asterisk	< 1:13.14.1~dfsg-2+deb9u6	asterisk_1:13.14.1~dfsg-2+deb9u6_amd64.deb
Debian	9	armel	asterisk-mysql	< 1:13.14.1~dfsg-2+deb9u6	asterisk-mysql_1:13.14.1~dfsg-2+deb9u6_armel.deb
Debian	10	amd64	asterisk-ooh323-dbgsym	< 1:16.2.1~dfsg-1+deb10u2	asterisk-ooh323-dbgsym_1:16.2.1~dfsg-1+deb10u2_amd64.deb
Debian	10	s390x	asterisk-voicemail-odbcstorage-dbgsym	< 1:16.2.1~dfsg-1+deb10u2	asterisk-voicemail-odbcstorage-dbgsym_1:16.2.1~dfsg-1+deb10u2_s390x.deb
Debian	9	amd64	asterisk-mp3	< 1:13.14.1~dfsg-2+deb9u6	asterisk-mp3_1:13.14.1~dfsg-2+deb9u6_amd64.deb
Debian	10	arm64	asterisk-dahdi-dbgsym	< 1:16.2.1~dfsg-1+deb10u2	asterisk-dahdi-dbgsym_1:16.2.1~dfsg-1+deb10u2_arm64.deb
Debian	8	armhf	asterisk-dahdi	< 1:11.13.1~dfsg-2+deb8u7	asterisk-dahdi_1:11.13.1~dfsg-2+deb8u7_armhf.deb
Debian	8	amd64	asterisk-ooh323	< 1:11.13.1~dfsg-2+deb8u7	asterisk-ooh323_1:11.13.1~dfsg-2+deb8u7_amd64.deb
Debian	10	arm64	asterisk-tests-dbgsym	< 1:16.2.1~dfsg-1+deb10u2	asterisk-tests-dbgsym_1:16.2.1~dfsg-1+deb10u2_arm64.deb
Debian	9	i386	asterisk-voicemail-imapstorage	< 1:13.14.1~dfsg-2+deb9u6	asterisk-voicemail-imapstorage_1:13.14.1~dfsg-2+deb9u6_i386.deb