Asterisk Audio Transcoding DoS Vulnerability (AST-2019-005)

Asterisk is prone to a denial of service vulnerability in audio transcoding.

This issue presented itself when an RTP packet containing no audio (and thus no samples) was received. In a particular transcoding scenario this audio frame would get turned into a frame with no origin information. If this new frame was then given to the audio transcoding support a crash would occur as no samples and no origin information would be present. The transcoding scenario requires the 'genericplc' option to be set to enabled (the default) and a transcoding path from the source format into signed linear and then from signed linear into another format.

Asterisk Open Source 13.28.0 and 16.5.0.

Checks if a vulnerable version is present on the target host.

Upgrade to Version 13.28.1, 16.5.1 or later.