CVE-2019-15639 : main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker

main/translate.c in Sangoma Asterisk 13.28.0 and 16.5.0 allows a remote attacker to send a specific RTP packet during a call and cause a crash in a specific scenario.

Published 2019-09-09 13:15:12

Updated 2019-09-10 16:49:37

Source MITRE

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2019-15639

Digium » Asterisk
Versions from including (>=) 16.0.0 and up to, including, (<=) 16.5.0
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Matching versions
Digium » Asterisk
Versions from including (>=) 13.0.0 and up to, including, (<=) 13.28.0
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2019-15639

Top countries where our scanners detected CVE-2019-15639

Top open port discovered on systems with this issue 8088

IPs affected by CVE-2019-15639 14,390

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2019-15639!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2019-15639

EPSS FAQ

0.44%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 71 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-15639

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2019-15639

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2019-15639

http://packetstormsecurity.com/files/154372/Asterisk-Project-Security-Advisory-AST-2019-005.html

Asterisk Project Security Advisory - AST-2019-005 ≈ Packet Storm
Third Party Advisory;VDB Entry
http://downloads.asterisk.org/pub/security/AST-2019-005.html

AST-2019-005
Vendor Advisory