The Asterisk Development Team would like to announce security releases for
Asterisk 13, 16 and 17, and Certified Asterisk 13.21. The available releases are
released as versions 13.29.2, 16.6.2, 17.0.1 and 13.21-cert5.

These releases are available for immediate download at

https://downloads.asterisk.org/pub/telephony/asterisk/releases
https://downloads.asterisk.org/pub/telephony/certified-asterisk/releases

The following security vulnerabilities were resolved in these versions:

• • AST-2019-006: SIP request can change address of a SIP peer.
    A SIP request can be sent to Asterisk that can change a SIP peer’s IP
    address. A REGISTER does not need to occur, and calls can be hijacked as a
    result. The only thing that needs to be known is the peer’s name;
    authentication details such as passwords do not need to be known. This
    vulnerability is only exploitable when the “nat” option is set to the
    default, or “auto_force_rport”.

• • AST-2019-007: AMI user could execute system commands.
    A remote authenticated Asterisk Manager Interface (AMI) user without
    “system” authorization could use a specially crafted “Originate” AMI
    request to execute arbitrary system commands.

• AST-2019-008: Re-invite with T.38 and malformed SDP causes crash.
  If Asterisk receives a re-invite initiating T.38 faxing and has a port of 0
  and no c line in the SDP, a crash will occur.

For a full list of changes in the current releases, please see the ChangeLogs:

ChangeLog-13.29.2
ChangeLog-16.6.2
ChangeLog-17.0.1
ChangeLog-certified-13.21-cert5

The security advisories are available at:

AST-2019-006.pdf
AST-2019-007.pdf
AST-2019-008.pdf

Thank you for your continued support of Asterisk!