CVE-2025-49832
📋 TL;DR
Asterisk has a vulnerability in its STIR/SHAKEN verification module that allows remote attackers to cause denial of service or potentially execute arbitrary code. This affects Asterisk installations with STIR/SHAKEN enabled or where attackers can set arbitrary Identity headers. Systems running vulnerable versions of Asterisk are at risk.
💻 Affected Systems
- Asterisk
📦 What is this software?
Asterisk by Sangoma
Asterisk by Sangoma
Asterisk by Sangoma
Asterisk by Sangoma
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise and data exfiltration
Likely Case
Remote denial of service causing telephony service disruption
If Mitigated
Limited impact with proper network segmentation and access controls
🎯 Exploit Status
Requires ability to set arbitrary Identity headers or STIR/SHAKEN enabled with verification configured
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 18.26.3, 20.7-cert6, 20.15.1, 21.10.1, 22.5.1
Vendor Advisory: https://github.com/asterisk/asterisk/security/advisories/GHSA-mrq5-74j5-f5cr
Restart Required: Yes
Instructions:
1. Identify your Asterisk version. 2. Upgrade to the patched version for your branch. 3. Restart Asterisk service. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Disable STIR/SHAKEN verification
allTemporarily disable STIR/SHAKEN verification in SIP profiles if not required
Edit sip.conf or relevant configuration file and set 'stir_shaken_verification = no' in affected profiles
Restrict Identity header manipulation
allImplement SIP header validation to prevent arbitrary Identity header manipulation
Configure SIP firewall rules to validate and sanitize Identity headers
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Asterisk servers
- Deploy SIP-aware firewalls to filter and validate Identity headers
🔍 How to Verify
Check if Vulnerable:
Check Asterisk version and verify if STIR/SHAKEN is enabled with verification in SIP profilesCheck Version:
asterisk -VVerify Fix Applied:
Verify Asterisk version is updated to patched version and test STIR/SHAKEN functionality📡 Detection & Monitoring
Log Indicators:
- Unusual SIP Identity header patterns
- STIR/SHAKEN verification failures
- Asterisk process crashes
Network Indicators:
- Malformed SIP packets with manipulated Identity headers
- Unusual traffic patterns to STIR/SHAKEN endpoints
SIEM Query:
source="asterisk" AND ("stir_shaken" OR "verification.c" OR "Identity header")