vulnerability
FreeBSD: VID-A8D94711-0D03-11EA-87CA-001999F8D30B (CVE-2019-18790): asterisk -- SIP request can change address of a SIP peer
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 6 | (AV:N/AC:M/Au:N/C:P/I:P/A:N) | 2019-10-17 | 2019-11-22 | 2020-01-22 |
Description
Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below.
From VID-A8D94711-0D03-11EA-87CA-001999F8D30B:
The Asterisk project reports:
A SIP request can be sent to Asterisk that can change
a SIP peers IP address. A REGISTER does not need to occur,
and calls can be hijacked as a result. The only thing
that needs to be known is the peers name; authentication
details such as passwords do not need to be known. This
vulnerability is only exploitable when the nat option is
set to the default, or auto_force_rport.
Solution(s)
References
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.