CVE-2016-9938

CVE-2016-9938 describes a vulnerability in Asterisk Open Source and Certified Asterisk versions 11.x, 13.x, and 14.x, specifically within the chan_sip channel driver. This flaw allows an attacker to bypass authentication on Asterisk systems when used in conjunction with certain SIP proxies. By manipulating whitespace in SIP headers, an attacker can make an INVITE request appear as an unauthenticated, out-of-dialog request to Asterisk, even if the proxy initially authenticated it as an in-dialog request. The vulnerability has a CVSS v3.0 score of 5.3 (Medium), indicating it can be exploited remotely with low attack complexity and no user interaction, leading to a low impact on integrity (unauthorized call processing). However, it only affects specific configurations where Asterisk uses chan_sip with an authenticating SIP proxy that is not dialog-aware. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, suggesting it has not garnered significant attention from the security community.