جزئیات آسیب‌پذیری

CVE-2026-57199

asterisk asteriskasterisk certified-asterisk

Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers

CVSS 4.0

2.3پایین

نمای کلی اکسپلویت‌های عمومی اخبار مرتبط خط زمانی

خلاصه‌ی فارسی

خلاصه‌ی فارسی برای این آسیب‌پذیری هنوز تهیه نشده است.

شرح رسمی (انگلیسی)

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers` without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the `SMS` dialplan application, which is useful when routing calls to or from `analog devices`, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

امتیازهای CVSS

امتیاز	نسخه	منبع	بردار
2.3پایین	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N`

محصولات آسیب‌پذیر

فروشنده	محصول	نسخه‌ها	منبع
asterisk	asterisk	< 20.20.1	CVEProject cvelistV5 (CNA)
asterisk	asterisk	>= 21.0.0-pre1, < 21.12.3	CVEProject cvelistV5 (CNA)
asterisk	asterisk	>= 22.0.0-pre1, < 22.10.1	CVEProject cvelistV5 (CNA)
asterisk	asterisk	>= 23.0.0-pre1, < 23.4.1	CVEProject cvelistV5 (CNA)
asterisk	certified-asterisk	< 20.7-cert11	CVEProject cvelistV5 (CNA)
asterisk	certified-asterisk	>= 22.8-cert1-pre1, < 22.8-cert3	CVEProject cvelistV5 (CNA)

منابع و راهنماها

۱۵

https://github.com/asterisk/asterisk/security/advisories/GHSA-q9fr-m7g8-6ph5 x_refsource_CONFIRM
https://github.com/asterisk/asterisk/commit/15c66022dc441ec63d7bd5f53cf7f35db72964be x_refsource_MISC
https://github.com/asterisk/asterisk/commit/38a2059eb77a91a6b6e76eeba5875c2b96027368 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/59b74276f24ba104d859f3f05897c9b8d835a28a x_refsource_MISC
https://github.com/asterisk/asterisk/commit/60f4ef3deac6b9af30519b46c13f103264038b82 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/661d6a2fc5cc7744ab9d849ed3c73ae5066386df x_refsource_MISC
https://github.com/asterisk/asterisk/commit/7048a3841df99e090b9d87246600373581629c98 x_refsource_MISC
https://github.com/asterisk/asterisk/commit/f46f63bd4d33665d336cf8b5998650b915222549 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/20.20.1 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/21.12.3 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/22.10.1 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/23.4.1 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/certified-20.7-cert11 x_refsource_MISC
https://github.com/asterisk/asterisk/releases/tag/certified-22.8-cert3 x_refsource_MISC
https://github.com/asterisk/asterisk/tree/24.0.0-pre1 x_refsource_MISC

اطلاعات

تاریخ انتشار: ۱۴۰۵/۰۸/۰۶
آخرین به‌روزرسانی: ۱۴۰۵/۰۸/۱۲
وضعیت: PUBLISHED
صادرکننده (CNA): GitHub_M
اولویت کلون: به‌زودی

پیش‌بینی بهره‌برداری (EPSS)

۰٫۴۸٪

احتمال بهره‌برداری در ۳۰ روز

۴۱٫۵٪

صدک (نسبت به همه‌ی CVEها)

ارزیابی SSVC (CISA)

Automatable: no
Exploitation: none
Technical Impact: partial

ضعف‌ها (CWE)

CWE-787
Out-of-bounds Write