Denial of Service Vulnerability in Multiple Asterisk Products

Asterisk Certified Asterisk and Asterisk Open Source are products of Digium Corporation, U.S.A. Asterisk Open Source is a suite of open source telephone exchange PBX system software. The software supports voicemail, multi-party voice conferencing, Interactive Voice Response IVR and more. A remote...

Asterisk 13.13 < 13.13-cert4 / 13.x < 13.15.1 / 14.x < 14.4.1 Multiple Vulnerabilities (AST-2017-002 - AST-2017-004)

According to its SIP banner, the version of Asterisk running on the remote host is 13.13 prior to 13.13-cert4, 13.x prior to 13.15.1, or 14.x prior to 14.4.1. Is it, therefore, affected by multiple vulnerabilities : - An out-of-bounds read error exists in the multi-part body parser in PJSIP due t...

Asterisk 14.4.0 PJSIP 2.6 Heap Overflow

Heap overflow in CSEQ header parsing affects Asterisk chanpjsip and PJSIP - Authors: - Alfred Farrugia - Sandro Gauci - Vulnerable version: Asterisk 14.4.0 running chanpjsip, PJSIP 2.6 - References: AST-2017-002 - Enable Security Advisory: - Vendor Advisory: - Timeline: - Report date: 2017-04-12 ...

FreeBSD : asterisk -- Buffer Overrun in PJSIP transaction layer (0537afa3-3ce0-11e7-bf9d-001999f8d30b)

The Asterisk project reports : A remote crash can be triggered by sending a SIP packet to Asterisk with a specially crafted CSeq header and a Via header with no branch parameter. The issue is that the PJSIP RFC 2543 transaction key generation algorithm does not allocate a large enough buffer. By...

Asterisk 14.4.0 PJSIP 2.6 Denial Of Service

Out of bound memory access in PJSIP multipart parser crashes Asterisk - Authors: - Alfred Farrugia - Sandro Gauci - Vulnerable version: Asterisk 14.4.0 running chanpjsip, PJSIP 2.6 - References: AST-2017-003 - Enable Security Advisory: - Vendor Advisory: - Timeline: - Report date: 2017-04-13 -...

Asterisk 14.4.0 Skinny Denial Of Service

Asterisk Skinny memory exhaustion vulnerability leads to DoS - Authors: - Alfred Farrugia - Sandro Gauci - Vulnerable version: Asterisk 14.4.0 with chanskinny enabled - References: AST-2017-004 - Enable Security Advisory: - Vendor Advisory: - Timeline: - Report date: 2017-04-13 - Digium confirmed...

FreeBSD : asterisk -- Memory exhaustion on short SCCP packets (fab87bff-3ce5-11e7-bf9d-001999f8d30b)

The Asterisk project reports : A remote memory exhaustion can be triggered by sending an SCCP packet to Asterisk system with 'chanskinny' enabled that is larger than the length of the SCCP header but smaller than the packet length specified in the header. The loop that reads the rest of the packe...

Hydra 8.5 - Network Logon Cracker

A very fast network logon cracker which support many different services. See feature sets and services coverage page - incl. a speed comparison against ncrack and medusa.Number one of the biggest security holes are passwords, as every password security study shows. This tool is a proof of concept...

Digium Asterisk CDR ast_cdr_setuserfield Buffer Overflow (CVE-2017-16671; CVE-2017-7617)

A buffer overflow exists in the CDR engine of Digium Asterisk. The vulnerability is due to a lack of size checking when setting the user field of a CDR. A remote, authenticated attacker can exploit this vulnerability by sending a crafted message to an affected Asterisk server...

Asterisk Open Source and Certified Asterisk RTP Resource Exhaustion DoS Vulnerability

Asterisk Open Source and Certified Asterisk are prone to a remote denial of service DoS vulnerability. This VT has been deprecated since this check is already covered in SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyrigh...

CVE-2016-7551

chainsip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service port exhaustion...

CVE-2016-7551

chainsip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service port exhaustion...

DEBIAN-CVE-2016-7551

chainsip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service port exhaustion...

UBUNTU-CVE-2016-7551

chainsip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service port exhaustion...

CVE-2016-7551

chainsip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service port exhaustion...

CVE-2016-7551

chainsip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service port exhaustion...

Code injection

chainsip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service port exhaustion...

CVE-2016-7551

chainsip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service port exhaustion...

CVE-2016-7551

chainsip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3 allows remote attackers to cause a denial of service port exhaustion...

CVE-2016-7551

CVE-2016-7551 affects Asterisk Open Source 11.x (before 11.23.1) and 13.x (before 13.11.1), as well as Certified Asterisk 11.6 (before 11.6-cert15) and 13.8 (before 13.8-cert3). The vulnerability in chain_sip allows remote attackers to cause a denial of service via port exhaustion. The available ...