Vulnerability record · CVE-2018-7284 · published 22 February 2018
CVE-2018-7284: Asterisk res_pjsip_pubsub Accept header buffer overflow
Digium · Asterisk
Asterisk's res_pjsip_pubsub module fails to enforce its fixed 32-header limit when storing accepted formats from Accept headers in a SUBSCRIBE request. Supplying more than 32 Accept headers causes an out-of-bounds write, crashing the process. The flaw affects Asterisk through 13.19.1, 14.x through 14.7.5, 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2.
Description
A Buffer Overflow issue was discovered in Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2. When processing a SUBSCRIBE request, the res_pjsip_pubsub module stores the accepted formats present in the Accept headers of the request. This code did not limit the number of headers it processed, despite having a fixed limit of 32. If more than 32 Accept headers were present, the code would write outside of its memory and cause a crash.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Automated analysis
high priorityUnauthenticated remote denial of service with a public exploit and very high EPSS, though no KEV listing and impact limited to availability.
What it is
Asterisk's res_pjsip_pubsub module fails to enforce its fixed 32-header limit when storing accepted formats from Accept headers in a SUBSCRIBE request. Supplying more than 32 Accept headers causes an out-of-bounds write, crashing the process. The flaw affects Asterisk through 13.19.1, 14.x through 14.7.5, 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2.
Impact
An unauthenticated remote attacker can crash the Asterisk process, causing a denial of service for telephony services. The CVSS vector shows only availability impact, so no confidentiality or integrity loss is expected from this flaw.
Attack surface
Reachable over the network via SIP SUBSCRIBE requests to the PJSIP stack; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV, but EPSS is high (0.57662, 99th percentile) and a public Exploit-DB entry (44184) exists, indicating exploit code is available.
What to do
- Upgrade Asterisk to a version after 13.19.1, 14.7.5, or 15.2.1, or Certified Asterisk after 13.18-cert2, per vendor advisory AST-2018-004.
- Apply the Debian security update DSA-4320 if running the Debian package.
- Restrict SIP SUBSCRIBE traffic to trusted peers and networks where possible.
- Monitor for and rate-limit SIP requests containing an unusually high number of Accept headers.
Detection
- Inspect SIP traffic for SUBSCRIBE requests with more than 32 Accept headers.
- Alert on Asterisk process crashes or restarts correlated with inbound SIP SUBSCRIBE bursts.
- Review PJSIP logs for malformed or excessive Accept header handling errors.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://downloads.asterisk.org/pub/security/AST-2018-004.html | PatchVendor Advisory |
| http://www.securityfocus.com/bid/103151 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1040416 | Third Party AdvisoryVDB Entry |
| https://www.debian.org/security/2018/dsa-4320 | Third Party Advisory |
| https://www.exploit-db.com/exploits/44184/ | ExploitThird Party AdvisoryVDB Entry |
| http://downloads.asterisk.org/pub/security/AST-2018-004.html | PatchVendor Advisory |
| http://www.securityfocus.com/bid/103151 | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1040416 | Third Party AdvisoryVDB Entry |
| https://www.debian.org/security/2018/dsa-4320 | Third Party Advisory |
| https://www.exploit-db.com/exploits/44184/ | ExploitThird Party AdvisoryVDB Entry |
Track CVE-2018-7284 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-7284), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
