CVE-2023-37457 : Vulnerability Insights and Analysis

Asterisk's PJSIP_HEADER dialplan function can overwrite memory or cause a crash when using 'update'.

Understanding CVE-2023-37457

Asterisk, an open-source private branch exchange and telephony toolkit, is impacted by a vulnerability where the 'update' functionality of the PJSIP_HEADER dialplan function can lead to memory overwrites or crashes.

What is CVE-2023-37457?

In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, 21.0.0, and certified-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space, potentially causing memory corruption or crashes. This issue is not externally exploitable unless the dialplan is explicitly set to update a header using data from an external source.

The Impact of CVE-2023-37457

The impact of CVE-2023-37457 is rated as HIGH with a CVSS v3.1 base score of 7.5. The vulnerability requires LOW attack complexity and has a NETWORK attack vector, leading to HIGH availability impact.

Technical Details of CVE-2023-37457

The vulnerability is classified under CWE-120, which refers to Buffer Copy without Checking Size of Input ('Classic Buffer Overflow').

Vulnerability Description

The 'update' functionality of the PJSIP_HEADER dialplan function in affected Asterisk versions can overwrite memory or cause crashes due to exceeding buffer space allocation for header values. A patch is available to address this issue.

Affected Systems and Versions

Asterisk versions <= 18.20.0
Asterisk versions >= 19.0.0, <= 20.5.0
Asterisk version = 21.0.0
Certified-asterisk version <= 18.9-cert5

Exploitation Mechanism

The vulnerability can be triggered when the 'update' functionality of the PJSIP_HEADER dialplan function is used to update headers beyond allocated buffer space.

Mitigation and Prevention

Immediate Steps to Take:

Apply the patch available at commit a1ca0268254374b515fa5992f01340f7717113fa

Long-Term Security Practices:

Regularly update Asterisk to patched versions

Patching and Updates:

Ensure all affected versions are updated to versions that include the security patch.