There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1
    allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a
    buffer size is supposed to match an expanded length but actually matches a compressed length.
    (CVE-2018-19278)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1
    allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a
    buffer size is supposed to match an expanded length but actually matches a compressed length.
    (CVE-2018-19278)

  - An Integer Signedness issue (for a return code) in the res_pjsip_sdp_rtp module in Digium Asterisk
    versions 15.7.1 and earlier and 16.1.1 and earlier allows remote authenticated users to crash Asterisk via
    a specially crafted SDP protocol violation. (CVE-2019-7251)

  - Buffer overflow in res_pjsip_messaging in Digium Asterisk versions 13.21-cert3, 13.27.0, 15.7.2, 16.4.0
    and earlier allows remote authenticated users to crash Asterisk by sending a specially crafted SIP MESSAGE
    message. (CVE-2019-12827)

  - An issue was discovered in Asterisk Open Source through 13.27.0, 14.x and 15.x through 15.7.2, and 16.x
    through 16.4.0, and Certified Asterisk through 13.21-cert3. A pointer dereference in chan_sip while
    handling SDP negotiation allows an attacker to crash Asterisk when handling an SDP answer to an outgoing
    T.38 re-invite. To exploit this vulnerability an attacker must cause the chan_sip module to send a T.38
    re-invite request to them. Upon receipt, the attacker must send an SDP answer containing both a T.38 UDPTL
    stream and another media stream containing only a codec (which is not permitted according to the chan_sip
    configuration). (CVE-2019-13161)

  - res_pjsip_t38 in Sangoma Asterisk 15.x before 15.7.4 and 16.x before 16.5.1 allows an attacker to trigger
    a crash by sending a declined stream in a response to a T.38 re-invite initiated by Asterisk. The crash
    occurs because of a NULL session media object dereference. (CVE-2019-15297)

根據其 SIP 標題判斷，遠端主機上執行的 Asterisk 版本為 15.6.2 之前的 15.x 版或 16.0.1 之前的 16.x 版。因此，會受到「dns_srv」和「dns_naptr」函式的相關錯誤影響，如 AST-2018-010 所述。此錯誤允許拒絕服務攻擊。同樣，請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼。

根据其 SIP 标题，远程主机上运行的 Asterisk 版本为低于 15.6.2 的 15.x、低于 16.0.1 的 16.x。因而，受到 AST-2018-010 所述的与 'dns_srv' 和 'dns_naptr' 函数相关的错误的影响。此错误允许拒绝服务攻击。另请注意，Nessus 并未测试这些问题，而是只依赖于应用程序自我报告的版本号。

SIPバナーによると、リモートホストで実行されているAsteriskのバージョンは、15.6.2より前の15.x、16.0.1より前の16.xです。したがって、AST-2018-010に記載されているとおり、「dns_srv」と「dns_naptr」機能に関連するエラーの影響を受けます。このエラーにより、サービス拒否攻撃が発生する可能性があります。Nessusはこれらの問題をテストしておらず、代わりにアプリケーションの自己報告されたバージョン番号にのみ依存しています。

According to its SIP banner, the version of Asterisk running on the remote host is 15.x prior to 15.6.2, 16.x prior to 16.0.1. It is therefore, affected by an error related to the functions 'dns_srv' and 'dns_naptr' described in AST-2018-010. This error allows denial of service attacks.

Also note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
423679	Alpine: multiple asterisk packages: security update to 15.7.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2025/4/4	2026/7/2	high
403575	Alpine: asterisk: security update to 15.6.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
423679	Alpine: multiple asterisk packages: security update to 15.7.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	2025/4/4	2026/7/2	high
403575	Alpine: asterisk: security update to 15.6.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	2023/10/31	2026/7/2	high
118974	Asterisk 15.x < 15.6.2 / 16.x < 16.0.1 DoS (AST-2018-010)	Nessus	Misc.	2018/11/15	2024/7/22	high
118974	Asterisk 15.x < 15.6.2 / 16.x < 16.0.1 DoS (AST-2018-010)	Nessus	Misc.	2018/11/15	2024/7/22	high
118974	Asterisk 15.x < 15.6.2/16.x < 16.0.1 DoS（AST-2018-010）	Nessus	Misc.	2018/11/15	2024/7/22	high
118974	Asterisk 15.x < 15.6.2 / 16.x < 16.0.1 DoS (AST-2018-010)	Nessus	Misc.	2018/11/15	2024/7/22	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high