Asterisk Multiple Vulnerabilities

Multiple vulnerabilities identified in Asterisk, which a remote authenticated user can execute arbitrary code on the target system, cause denial of service conditions, and execute arbitrary shell commands on Asterisk Manager interface.

1. A remote user can send specially crafted SIP UPDATE request to cause Asterisk to perform a connected line update with no associated channel and crash.
2. A remote authenticated user can send specially crafted KEYPAD_BUTTON_MESSAGE event data to trigger a heap overflow in the Skinny Channel Driver and execute arbitrary code on the target system. The code will run with the privileges of the target service.
3. A remote authenticated user on the Asterisk Manager interface can bypass a security check and execute shell commands.