CVE-2023-37457 Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'
A buffer overflow in Asterisk's PJSIP_HEADER update function allows memory corruption or crashes if dialplans process external data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-37457?
CVE-2023-37457 is a high-severity memory corruption vulnerability in Digium Asterisk, published on 14 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Asterisk is an open source private branch exchange and telephony toolkit. In Asterisk versions 18.20.0 and prior, 20.5.0 and prior, and 21.0.0; as well as ceritifed-asterisk 18.9-cert5 and prior, the 'update' functionality of the PJSIP_HEADER dialplan function can exceed the available buffer space for storing the new value of a header. By doing so this can overwrite memory or cause a crash. This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source. If the 'update' functionality is not used the vulnerability does not occur. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.
Weakness: CWE-120
Which versions are affected by CVE-2023-37457?
It affects 2 products.
Products include Digium Asterisk, Sangoma Certified Asterisk.
How do I fix CVE-2023-37457?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-37457 being exploited?
There is no known exploitation of CVE-2023-37457 in the wild and no public exploit code.
Other vulnerabilities in Digium Asterisk
Sources
Also known as ALPINE-CVE-2023-37457, DEBIAN-CVE-2023-37457, GHSA-98rc-4j27-74hh, UBUNTU-CVE-2023-37457.