CVE-2024-42491

What it actually does

Asterisk crashes with a segmentation fault when it attempts to send a SIP request to a URI whose host portion starts with .1 or [.1] while the res_resolver_unbound module is loaded.

Why it matters to the business

Unexpected downtime of the PBX system interrupts voice calls and related services until the process is restarted, with higher urgency for organizations using the affected module in production telephony environments.

How an attack unfolds

An attacker supplies or triggers a SIP URI beginning with .1 or [.1] that Asterisk must resolve; with res_resolver_unbound active the resolver mishandles the address and causes an immediate crash, resulting in denial of service.

How to fix it

Upgrade Asterisk to 18.24.3, 20.9.3, 21.4.3 or certified-asterisk to 18.9-cert12 or 20.7-cert2. As immediate mitigations, add noload = res_resolver_unbound.so to modules.conf or enable rewrite_contact = yes on all PJSIP endpoints.

How to confirm the fix worked

Confirm the running version matches a fixed release, verify that res_resolver_unbound is either unloaded or that rewrite_contact is enabled on endpoints, and test SIP request handling with target URIs beginning with .1 to ensure no crash occurs.

Typical attack path

1. Identify or configure an Asterisk deployment with res_resolver_unbound loaded
2. Cause Asterisk to initiate a SIP request toward a host starting with .1 or [.1]
3. Trigger the malformed resolution path leading to segmentation fault and process termination

How to detect it

Review Asterisk log files and system crash reports for segmentation faults occurring during SIP request processing when res_resolver_unbound is active; correlate with any sudden PBX process restarts.

What your security team should do

• Apply the listed version upgrades immediately on all Asterisk instances
• Implement one of the documented workarounds if patching cannot be completed within the next maintenance window
• Monitor for Asterisk process restarts and review logs for resolver-related faults
• Audit PJSIP endpoint configurations for contact rewrite settings across the environment