CVE-2025-49832 (CNNVD-202508-065)
中文标题:
Asterisk 代码问题漏洞
英文标题:
Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation
漏洞描述
中文描述:
Asterisk是Asterisk开源的一款PBX系统的软件，运行在Linux系统上，支持使用SIP、IAX、H323协议进行IP通话。 Asterisk存在代码问题漏洞，该漏洞源于asterisk/res/res_stir_shaken/verification.c存在远程拒绝服务和可能远程代码执行。
英文描述:
Asterisk is an open source private branch exchange and telephony toolkit. In versions up to and including 18.26.2, between 20.00.0 and 20.15.0, 20.7-cert6, 21.00.0, 22.00.0 through 22.5.0, there is a remote DoS and possible RCE condition in `asterisk/res/res_stir_shaken /verification.c` that can be exploited when an attacker can set an arbitrary Identity header, or STIR/SHAKEN is enabled, with verification set in the SIP profile associated with the endpoint to be attacked. This is fixed in versions 18.26.3, 20.7-cert6, 20.15.1, 21.10.1 and 22.5.1.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| asterisk | asterisk | < 18.26.3 | - | - |
cpe:2.3:a:asterisk:asterisk:<_18.26.3:*:*:*:*:*:*:*
|
| asterisk | asterisk | >= 20.00.0, < 20.15.1 | - | - |
cpe:2.3:a:asterisk:asterisk:>=_20.00.0,_<_20.15.1:*:*:*:*:*:*:*
|
| asterisk | asterisk | >= 21.00.0, < 21.10.1 | - | - |
cpe:2.3:a:asterisk:asterisk:>=_21.00.0,_<_21.10.1:*:*:*:*:*:*:*
|
| asterisk | asterisk | >= 22.00.0, < 22.5.1 | - | - |
cpe:2.3:a:asterisk:asterisk:>=_22.00.0,_<_22.5.1:*:*:*:*:*:*:*
|
| asterisk | asterisk | >= 20.7-cert6, < 20.7-cert7 | - | - |
cpe:2.3:a:asterisk:asterisk:>=_20.7-cert6,_<_20.7-cert7:*:*:*:*:*:*:*
|
| sangoma | asterisk | * | - | - |
cpe:2.3:a:sangoma:asterisk:*:*:*:*:*:*:*:*
|
| sangoma | certified_asterisk | * | - | - |
cpe:2.3:a:sangoma:certified_asterisk:*:*:*:*:*:*:*:*
|
| sangoma | certified_asterisk | 20.7 | - | - |
cpe:2.3:a:sangoma:certified_asterisk:20.7:cert1:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
CVSS评分详情
3.1 (cna)
MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-49832 |
2025-11-11 15:23:25 | 2025-11-11 07:40:38 |
| NVD | nvd_CVE-2025-49832 |
2025-11-11 15:00:58 | 2025-11-11 07:48:26 |
| CNNVD | cnnvd_CNNVD-202508-065 |
2025-11-11 15:12:52 | 2025-11-11 08:00:04 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 代码问题
- cnnvd_id: 未提取 -> CNNVD-202508-065
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 5 -> 8
- data_sources: ['cve'] -> ['cve', 'nvd']