CVE-2021-37706
📋 TL;DR
CVE-2021-37706 is an integer underflow vulnerability in PJSIP's STUN message processing that allows remote code execution. Attackers on the same network can send specially crafted UDP packets to execute arbitrary code on vulnerable systems. All users of PJSIP with STUN enabled are affected.
💻 Affected Systems
- PJSIP (pjproject)
- Asterisk PBX
- Other software using PJSIP library
📦 What is this software?
Asterisk by Sangoma
Asterisk by Sangoma
Asterisk by Sangoma
Pjsip by Teluu
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution with system compromise, allowing attacker to install malware, exfiltrate data, or pivot to other systems.
Likely Case
Service disruption through denial of service or limited code execution within the PJSIP process context.
If Mitigated
Network segmentation prevents exploitation; vulnerable systems isolated from untrusted networks remain protected.
🎯 Exploit Status
Exploit requires network access to STUN port (typically UDP 3478 or configured port). Proof of concept available in public disclosures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions with commit 15663e3f37091069b8c98a7fce680dc04bc8e865 or later
Vendor Advisory: https://github.com/pjsip/pjproject/security/advisories/GHSA-2qpg-f6wf-w984
Restart Required: Yes
Instructions:
1. Update PJSIP to latest version or apply commit 15663e3f37091069b8c98a7fce680dc04bc8e865. 2. Recompile and reinstall. 3. Restart all services using PJSIP. 4. For Asterisk: update to patched version per AST-2022-004 advisory.
🔧 Temporary Workarounds
Disable STUN
allDisable STUN functionality in PJSIP configuration if not required
# Edit PJSIP config to disable STUN
# For Asterisk: set 'icesupport=no' in pjsip.conf
Network filtering
linuxBlock UDP STUN traffic at network perimeter
# Example iptables rule: iptables -A INPUT -p udp --dport 3478 -j DROP
# Adjust port based on your configuration
🧯 If You Can't Patch
- Segment network to isolate PJSIP systems from untrusted networks
- Implement strict firewall rules to allow STUN traffic only from trusted sources
🔍 How to Verify
Check if Vulnerable:
Check PJSIP version or git commit hash. If using pre-commit 15663e3f37091069b8c98a7fce680dc04bc8e865, vulnerable.Check Version:
pkg-config --modversion libpjproject || check software version using PJSIPVerify Fix Applied:
Verify commit 15663e3f37091069b8c98a7fce680dc04bc8e865 is present in source or check version against patched releases.📡 Detection & Monitoring
Log Indicators:
- STUN error messages
- Process crashes in PJSIP/Asterisk logs
- Unexpected memory access errors
Network Indicators:
- Malformed STUN packets with ERROR-CODE attribute
- UDP traffic to STUN ports with unusual patterns
SIEM Query:
source="*pjsip*" OR source="*asterisk*" AND ("crash" OR "segfault" OR "STUN error")🔗 References
- http://packetstormsecurity.com/files/166225/Asterisk-Project-Security-Advisory-AST-2022-004.html
- http://seclists.org/fulldisclosure/2022/Mar/0
- https://github.com/pjsip/pjproject/commit/15663e3f37091069b8c98a7fce680dc04bc8e865
- https://github.com/pjsip/pjproject/security/advisories/GHSA-2qpg-f6wf-w984
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2022/dsa-5285
- http://packetstormsecurity.com/files/166225/Asterisk-Project-Security-Advisory-AST-2022-004.html
- http://seclists.org/fulldisclosure/2022/Mar/0
- https://github.com/pjsip/pjproject/commit/15663e3f37091069b8c98a7fce680dc04bc8e865
- https://github.com/pjsip/pjproject/security/advisories/GHSA-2qpg-f6wf-w984
- https://lists.debian.org/debian-lts-announce/2022/03/msg00035.html
- https://lists.debian.org/debian-lts-announce/2022/11/msg00021.html
- https://lists.debian.org/debian-lts-announce/2023/08/msg00038.html
- https://lists.debian.org/debian-lts-announce/2024/09/msg00030.html
- https://security.gentoo.org/glsa/202210-37
- https://www.debian.org/security/2022/dsa-5285
