AST-2016-008: Crash on SDP offer or answer from endpoint using Opus

 Asterisk Project Security Advisory - AST-2016-008

         Product        Asterisk
         Summary        Crash on SDP offer or answer from endpoint using
                        Opus
    Nature of Advisory  Remote Crash
      Susceptibility    Remote unauthenticated sessions
         Severity       Critical
      Exploits Known    No
       Reported On      November 11, 2016
       Reported By      jorgen
        Posted On
     Last Updated On    November 15, 2016
     Advisory Contact   jcolp AT digium DOT com
         CVE Name

    Description  If an SDP offer or answer is received with the Opus codec
                 and with the format parameters separated using a space the
                 code responsible for parsing will recursively call itself
                 until it crashes. This occurs as the code does not properly
                 handle spaces separating the parameters. This does NOT
                 require the endpoint to have Opus configured in Asterisk.
                 This also does not require the endpoint to be
                 authenticated. If guest is enabled for chan_sip or
                 anonymous in chan_pjsip an SDP offer or answer is still
                 processed and the crash occurs.

    Resolution  The code has been updated to properly handle spaces
                separating parameters in the fmtp line. Upgrade to a
                released version with the fix incorporated or apply patch.

                               Affected Versions
                      Product                    Release
                                                 Series
               Asterisk Open Source               13.x    13.12.0 and higher
               Asterisk Open Source               14.x    All Versions

                                  Corrected In
                            Product                              Release
                     Asterisk Open Source                    13.13.1, 14.2.1

                                    Patches
                                SVN URL                              Revision
   http://downloads.asterisk.org/pub/security/AST-2016-008-13.diff   Asterisk
                                                                     13
   http://downloads.asterisk.org/pub/security/AST-2016-008-14.diff   Asterisk
                                                                     14

    Links  https://issues.asterisk.org/jira/browse/ASTERISK-26579

    Asterisk Project Security Advisories are posted at
    http://www.asterisk.org/security

    This document may be superseded by later versions; if so, the latest
    version will be posted at
    http://downloads.digium.com/pub/security/AST-2016-008.pdf and
    http://downloads.digium.com/pub/security/AST-2016-008.html

                                Revision History
          Date           Editor                  Revisions Made
    November 15, 2016  Joshua Colp  Initial draft of Advisory

               Asterisk Project Security Advisory - AST-2016-008
               Copyright © 2016 Digium, Inc. All Rights Reserved.
  Permission is hereby granted to distribute and publish this advisory in its
                           original, unaltered form.