CVE-2025-57767
📋 TL;DR
This vulnerability in Asterisk allows remote attackers to cause a denial of service (crash) by sending specially crafted SIP requests with malformed Authorization headers. The crash occurs due to a NULL pointer dereference when processing authentication realms. All Asterisk installations using affected versions are vulnerable if they handle SIP traffic.
💻 Affected Systems
- Asterisk
📦 What is this software?
Asterisk by Sangoma
Asterisk by Sangoma
Asterisk by Sangoma
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker causes Asterisk service crash, disrupting all telephony services until manual restart.
Likely Case
Denial of service affecting telephony services, potentially causing dropped calls and service disruption.
If Mitigated
No impact if patched versions are deployed or if vulnerable systems are not exposed to untrusted networks.
🎯 Exploit Status
Exploitation requires sending a malformed SIP request, which is straightforward for attackers familiar with SIP protocol.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.15.2, 21.10.2, or 22.5.2 depending on your branch
Vendor Advisory: https://github.com/asterisk/asterisk/security/advisories/GHSA-64qc-9x89-rx5j
Restart Required: Yes
Instructions:
1. Identify your Asterisk version branch (20.x, 21.x, or 22.x). 2. Upgrade to the corresponding patched version: 20.15.2, 21.10.2, or 22.5.2. 3. Restart Asterisk service after upgrade.
🔧 Temporary Workarounds
No workarounds available
allThe vendor advisory states there are no workarounds for this vulnerability.
🧯 If You Can't Patch
- Restrict network access to Asterisk SIP ports (default 5060/5061) to trusted sources only using firewall rules.
- Implement network segmentation to isolate Asterisk servers from untrusted networks and potential attackers.
🔍 How to Verify
Check if Vulnerable:
Check Asterisk version with: asterisk -rx 'core show version'Check Version:
asterisk -rx 'core show version'Verify Fix Applied:
Verify version is 20.15.2, 21.10.2, or 22.5.2 or higher using: asterisk -rx 'core show version'📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in Asterisk logs
- Unexpected service crashes
- Failed authentication attempts with malformed realms
Network Indicators:
- SIP packets with Authorization headers containing unexpected realms
- Multiple SIP requests to authentication endpoints
SIEM Query:
source="asterisk.log" AND ("segmentation fault" OR "SEGV" OR "crash" OR "authentication failed")