CVE-2020-35776 : A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1,

A buffer overflow in res_pjsip_diversion.c in Sangoma Asterisk versions 13.38.1, 16.15.1, 17.9.1, and 18.1.1 allows remote attacker to crash Asterisk by deliberately misusing SIP 181 responses.

Published 2021-02-18 20:15:12

Updated 2021-02-24 17:43:09

Source MITRE

View at NVD, CVE.org

Vulnerability category: Overflow

Products affected by CVE-2020-35776

Digium » Asterisk
Versions from including (>=) 17.0.0 and up to, including, (<=) 17.9.1
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Matching versions
Digium » Asterisk
Versions from including (>=) 13.0.0 and up to, including, (<=) 13.38.1
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Matching versions
Digium » Asterisk
Versions from including (>=) 16.0.0 and up to, including, (<=) 16.15.1
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Matching versions
Digium » Asterisk
Versions from including (>=) 18.0 and up to, including, (<=) 18.1.1
cpe:2.3:a:digium:asterisk:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2020-35776

Top countries where our scanners detected CVE-2020-35776

Top open port discovered on systems with this issue 80

IPs affected by CVE-2020-35776 29,055

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-35776!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-35776

EPSS FAQ

0.10%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 29 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-35776

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:N/A:P	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2020-35776

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-35776

http://packetstormsecurity.com/files/161470/Asterisk-Project-Security-Advisory-AST-2021-001.html

Asterisk Project Security Advisory - AST-2021-001 ≈ Packet Storm
Patch;Third Party Advisory
https://issues.asterisk.org/

System Dashboard - Digium/Asterisk JIRA
Issue Tracking;Vendor Advisory
https://downloads.asterisk.org/pub/security/AST-2021-001.html

AST-2021-001
Vendor Advisory
http://seclists.org/fulldisclosure/2021/Feb/57

Full Disclosure: AST-2021-001: Remote crash in res_pjsip_diversion
Mailing List;Third Party Advisory
https://issues.asterisk.org/jira/browse/ASTERISK-29227

[ASTERISK-29227] res_pjsip_diversion: sending multiple 181 responses causes memory corruption and crash - Digium/Asterisk JIRA
Exploit;Issue Tracking;Patch;Vendor Advisory