SecBoard
Zurück zur CVE-Übersicht

CVE-2026-57199

NONE
Risk Signal Score0/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.5%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers` without sufficient bounds checks, allowing an attacker to corrupt memory or crash Asterisk. The administrator must explicitly use the `SMS` dialplan application, which is useful when routing calls to or from `analog devices`, and must not have ensured that data passed to the application is valid. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • Asterisk 20.20.1
  • Asterisk 21.12.3
  • Asterisk 22.10.1
  • Asterisk 23.4.1
  • Certified Asterisk 20.7-cert11
  • Certified Asterisk 22.8-cert3

Threat-Hunting-Queries

Detection for memory corruption or crashes in app_sms.c due to malformed SMS messages. This requires monitoring Asterisk logs for error messages related to app_sms, memory access violations, or unexpected service terminations. Specific log patterns may vary based on Asterisk configuration and logging levels.

Sentinel/Defender KQL

CommonSecurityLog | where DeviceVendor == "Asterisk" | where DeviceProduct == "Asterisk" | where Message has "app_sms" and (Message has "memory corruption" or Message has "crash" or Message has "segmentation fault" or Message has "unexpected termination")

Splunk SPL

index=your_asterisk_index sourcetype=asterisk | regex _raw="app_sms.*(memory corruption|crash|segmentation fault|unexpected termination)"

Sigma

title: Asterisk app_sms Memory Corruption
status: experimental
description: Detects potential memory corruption or crashes in Asterisk's app_sms module.
logsource:
  product: asterisk
  service: logs
detection:
  keywords:
    - 'app_sms'
    - 'memory corruption'
    - 'crash'
    - 'segmentation fault'
    - 'unexpected termination'
  condition: keywords
fields:
  - 'message'
level: high

Elastic ES|QL

FROM logs-asterisk-* | WHERE message : "app_sms" AND (message : "memory corruption" OR message : "crash" OR message : "segmentation fault" OR message : "unexpected termination")

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen