Design/Logic Flaw

2014-11-2415:59:00

PRIOn knowledge base

www.prio-n.com

7.1 High

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

82.2%

JSON

Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (crash) via an in-dialog INVITE with Replaces message, which triggers the channel to be hung up.

CPENameOperatorVersion
asteriskge12.0.0
asterisklt12.7.1
asteriskge13.0.0
asterisklt13.0.1

Name	Operator	Version
asterisk	ge	12.0.0
asterisk	lt	12.7.1
asterisk	ge	13.0.0
asterisk	lt	13.0.1

References

downloads.asterisk.org/pub/security/AST-2014-016.html