AST-2013-005: Remote Crash when Invalid SDP is sent in SIP Request

Asterisk Project Security Advisory - AST-2013-005 Product Asterisk Summary Remote Crash when Invalid SDP is sent in SIP Request Nature of Advisory Remote Crash Susceptibility Remote Unauthenticated Sessions Severity Major Exploits Known None Reported On July 03, 2013 Reported By Walter Doekes, OS...

PT-2012-3113

Name of the Vulnerable Software and Affected Versions Asterisk versions 1.8.x through 1.8.10.0 Asterisk versions 10.x through 10.2.0 Description The issue is related to a stack-based buffer overflow in the ast parse digest function, which can be triggered by a long string in an HTTP Digest...

Exploit for Asterisk Security Advisory AST-2011-013

A Metasploit module is attached that demonstrates how to enumerate Asterisk sip peers that have a nat setting different to the global sip nat setting as described in Asterisk Security Advisory AST-2011-013. The example below finds all peers with nat=yes, but the metasploit module will also work...

Fedora 15 : asterisk-1.8.4.4-2.fc15 (2011-8983)

Remove systemd dependencies from EL6 and F15 The Asterisk Development Team has announced the release of Asterisk versions 1.4.41.2, 1.6.2.18.2, and 1.8.4.4, which are security releases. These releases are available for immediate download at...

Debian DSA-2276-1 : asterisk - multiple denial of service

Paul Belanger reported a vulnerability in Asterisk identified as AST-2011-008CVE-2011-2529 through which an unauthenticated attacker may crash an Asterisk server remotely. A package containing a NULL char causes the SIP header parser to alter unrelated memory structures. Jared Mauch reported a...

Asterisk Remote Crash Vulnerability in voice mail application (AST-2012-011)

Binary data 6511.prm...

Asterisk SIP Channel Driver Denial of Service (AST-2011-007)

Binary data 5939.prm...

Fedora 14 : asterisk-1.6.2.18-1.fc14 (2011-6225)

The Asterisk Development Team has announced the release of Asterisk 1.6.2.18. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/ The release of Asterisk 1.6.2.18 resolves several issues reported by the community and would have not been possib...

Fedora 15 : asterisk-1.8.3.3-1.fc15 (2011-5835)

The Asterisk Development Team has announced security releases for Asterisk branches 1.4, 1.6.1, 1.6.2, and 1.8. The available security releases are released as versions 1.4.40.1, 1.6.1.25, 1.6.2.17.3, and 1.8.3.3. These releases are available for immediate download at...

Fedora 15 : asterisk-1.8.3.2-1.fc15 (2011-3958)

The Asterisk Development Team has announced security releases for Asterisk branches 1.6.1, 1.6.2, and 1.8. The available security releases are released as versions 1.6.1.24, 1.6.2.17.2, and 1.8.3.2. These releases are available for immediate download at...

Fedora 15 : asterisk-1.8.3-1.fc15 (2011-2360)

The Asterisk Development Team has announced the release of Asterisk 1.8.3. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/ The release of Asterisk 1.8.3 resolves several issues reported by the community and would have not been possible...

Asterisk main/udptl.c Buffer Overflows (AST-2011-002)

Binary data 5802.prm...

PT-2011-2394

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions prior to 1.4.38.1 Asterisk Open Source versions prior to 1.4.39.1 Asterisk Open Source versions prior to 1.6.1.21 Asterisk Open Source versions prior to 1.6.2.15.1 Asterisk Open Source versions prior to 1.6.2.16.1...

AST-2011-001: Stack buffer overflow in SIP channel driver

Asterisk Project Security Advisory - AST-2011-001 Product Asterisk Summary Stack buffer overflow in SIP channel driver Nature of Advisory Exploitable Stack Buffer Overflow Susceptibility Remote Authenticated Sessions Severity Moderate Exploits Known No Reported On January 11, 2011 Reported By...

asterisk -- Exploitable Stack Buffer Overflow

The Asterisk Development Team reports: The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully...

CVE-2009-4966

SQL injection vulnerability in the AST ZipCodeSearch astaddresszipsearch extension 0.5.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the AST ZipCodeSearch astaddresszipsearch extension 0.5.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-4966

SQL injection vulnerability in the AST ZipCodeSearch astaddresszipsearch extension 0.5.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-4966

CVE-2009-4966 is a SQL injection in the TYPO3 extension ast_addresszipsearch (ZipCodeSearch) version 0.5.4. The Red Hat/NVD entries confirm that remote attackers can execute arbitrary SQL commands via unspecified vectors. The impact is described as allowing unauthorized SQL execution; no specific...

CVE-2009-4966: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the AST ZipCodeSearch astaddresszipsearch extension 0.5.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...