AST-2016-007
Updated asterisk packages fixes security vulnerability
AST-2016-007 is a vulnerability with no CVSS score yet in asterisk, published October 18, 2016. No source lists public exploit code. Fixed in asterisk 11.23.1-1.mga5.
The overlap dialing feature in chan_sip allows chan_sip to report to a device that the number that has been dialed is incomplete and more digits are required. If this functionality is used with a device that has performed username/password authentication RTP resources are leaked. This occurs because the code fails to release the old RTP resources before allocating new ones in this scenario. If all resources are used then RTP port exhaustion will occur and no RTP sessions are able to be set up (AST-2016-007).
What each source reports
OSVMGASA-2016-0344 No score
Updated asterisk packages fixes security vulnerability
The overlap dialing feature in chan_sip allows chan_sip to report to a device that the number that has been dialed is incomplete and more digits are required. If this functionality is used with a device that has performed username/password authentication RTP resources are leaked. This occurs because the code fails to release the old RTP resources before allocating new ones in this scenario. If all resources are used then RTP port exhaustion will occur and no RTP sessions are able to be set up (AST-2016-007).
- Record
MGASA-2016-0344- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskMageia:5 |
before 11.23.1-1.mga5 | 11.23.1-1.mga5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | OSV |