| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| certified asterisk | = 16.8.0< 16.8.0 | 16.8.0 |
| asterisk | ≥ 16.0.0, < 16.24.1≥ 18.0.0, < 18.10.1≥ 19.0.0, < 19.2.1 | 16.24.118.10.119.2.1 |
| pjsip | ≤ 2.11.1 |
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In affected versions if the incoming STUN message contains an ERROR-CODE attribute, the header length is not checked before performing a subtraction operation, potentially resulting in an integer underflow scenario. This issue affects all users that use STUN. A malicious actor located within the victim’s network may forge and send a specially crafted UDP (STUN) message that could remotely execute arbitrary code on the victim’s machine. Users are advised to upgrade as soon as possible. There are no known workarounds.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン