CVE-2016-2316 Denial of service in n/a
Remote attackers can cause denial of service via file descriptor consumption in Asterisk when specific SIP timeout configurations are set.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-2316?
CVE-2016-2316 is a medium-severity denial of service vulnerability in Digium Asterisk, published on 22 Feb 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1 before 13.1-cert3, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service (file descriptor consumption) via vectors related to large retransmit timeout values.
Weakness: CWE-191
Which versions are affected by CVE-2016-2316?
It affects 3 products.
Products include Digium Asterisk, Digium Certified Asterisk, Fedoraproject Fedora.
How do I fix CVE-2016-2316?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2016-2316 being exploited?
There is no known exploitation of CVE-2016-2316 in the wild and no public exploit code.
Other vulnerabilities in Digium Asterisk
Sources
Also known as DEBIAN-CVE-2016-2316, GHSA-vjwh-4xjh-5595, MGASA-2016-0086, UBUNTU-CVE-2016-2316.