CVE-2018-7284

This vulnerability lets a remote attacker send a special SIP message that causes Asterisk to crash when it contains too many “Accept” fields. Think of it like overwhelming a system’s intake form with more entries than it can safely hold—eventually it falls over. The main business risk is losing voice/SIP service until it’s restarted.

This matters if your business runs Asterisk (or Certified Asterisk) and your SIP service can be reached over the network. It does not require a login or user interaction; it’s triggered by a remote SIP SUBSCRIBE request with more than 32 Accept headers. Only treat it as a real risk if your Asterisk is reachable and an attacker can send such SIP traffic to it.

This is AMBER because attackers can crash Asterisk remotely without authentication, and a public exploit is available. The vulnerability is reachable in a default configuration, so exposure can be common. While KEV is not listed, the combination of remote trigger and known exploit makes it a priority to patch promptly.

1. Confirm exposure

• Verify you run Asterisk or Certified Asterisk.
• Determine whether SIP endpoints are reachable from outside your network (internet-facing or otherwise). Check firewall rules and any port-forwarding for SIP-related traffic.
• Confirm whether your configuration enables PJSIP pubsub functionality used for SIP SUBSCRIBE (the affected code path is in res_pjsip_pubsub while processing SUBSCRIBE).

2. Confirm vulnerable version

• Check the running Asterisk version.
• The vulnerability is reported for: Asterisk through 13.19.1, 14.x through 14.7.5, and 15.x through 15.2.1, and Certified Asterisk through 13.18-cert2.

3. Patch/upgrade to the fixed build

• Apply the vendor remediation referenced by AST-2018-004 from the Asterisk security advisory.
• Use your distribution’s security update process if applicable (e.g., vendor-provided packages), ensuring the installed Asterisk build includes the fix.
• After upgrading, restart Asterisk and validate SIP functionality (including SUBSCRIBE handling, if used).

4. Temporary workaround (if patching is delayed)

• Block SIP traffic that could carry SUBSCRIBE requests from untrusted networks at the firewall.
• If you must expose SIP, restrict inbound access to only the known/trusted IP addresses of your SIP peers.
• Reduce exposure by ensuring there is no internet-facing port for SIP unless explicitly required.

5. What to monitor

• Monitor system logs for unexpected Asterisk crashes/restarts, especially around times when SIP SUBSCRIBE traffic is received.
• Review SIP traffic logs (if enabled) for SUBSCRIBE requests with unusually large numbers of Accept headers.

Note on CISA KEV

• This issue is not listed in CISA KEV.

Severity is high (Denial of Service) with network attack vector and no authentication required. The weakness is a buffer overflow (CWE-119) in Asterisk’s res_pjsip_pubsub logic when processing SIP SUBSCRIBE requests: it stores accepted formats from the request’s Accept headers but does not enforce the intended cap of 32 Accept headers, leading to memory corruption and a crash when more than 32 headers are provided. A public exploit is known, and press attention is rising; this aligns with the AMBER priority. EPSS was predicted (trend falling), but since KEV is not listed, the primary driver for action is the remote unauthenticated crash behavior and available exploit. Patch guidance is provided via AST-2018-004.