FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

asterisk -- Outbound INVITE loop on challenge with different nonce

Affected packages
asterisk13 < 13.37.1
asterisk16 < 16.14.1
asterisk18 < 18.0.1


VuXML ID 29b7f0be-1fb7-11eb-b9d4-001999f8d30b
Discovery 2020-11-05
Entry 2020-11-05

The Asterisk project reports:

If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur.