3558 matches found
CVE-2016-9938
An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chansip channel driver has a liberal definition for whitespace when attempting to strip the content betwe...
CVE-2016-9938
CVE-2016-9938 affects Asterisk Open Source chan_sip: improper stripping of non‑printable ASCII whitespace between SIP header name and a colon allows certain To/header combinations to bypass authentication when used with an authenticating SIP proxy. Affected: 11.x < 11.25.1, 13.x < 13.13.1, ...
CVE-2016-9937
An issue was discovered in Asterisk Open Source 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1. If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashe...
CVE-2016-9938
An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chansip channel driver has a liberal definition for whitespace when attempting to strip the content betwe...
CVE-2016-9937
CVE-2016-9937 affects Asterisk Open Source versions 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1. When an SDP offer/answer contains Opus and parameters separated by spaces, the Opus SDP parser recurses and crashes, causing a denial of service. The issue is remote and unauthenticated,...
FreeBSD : asterisk -- Crash on SDP offer or answer from endpoint using Opus (9e6640fe-be3a-11e6-b04f-001999f8d30b)
The Asterisk project reports : If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the...
Asterisk Open Source AST-2016-008 Denial of Service Vulnerability
Asterisk is an open source framework for building communication applications. Asterisk Open Source suffers from a remote denial of service vulnerability. An attacker exploiting this vulnerability could crash the application, causing a denial of service...
FreeBSD : asterisk -- Authentication Bypass (c0b13887-be44-11e6-b04f-001999f8d30b)
The Asterisk project reports : The chansip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable...
Asterisk SDP Offer DoS Vulnerability (AST-2016-008)
Asterisk is prone to a SDP offer denial of service DoS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Asterisk Authentication Bypass Vulnerability (AST-2016-009)
Asterisk is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk"; if...
asterisk -- Authentication Bypass
The Asterisk project reports: The chansip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable...
asterisk -- Crash on SDP offer or answer from endpoint using Opus
The Asterisk project reports: If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the...
Digium Asterisk Denial of Service Vulnerability
Digium Asterisk is a set of open source telephone exchange PBX system software from Digium, USA. The software supports voicemail, multi-party voice conferencing, interactive voice response IVR and so on. A security vulnerability exists in Digium Asterisk. An attacker could exploit the vulnerabili...
Debian DSA-3700-1 : asterisk - security update
Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service or incorrect certificate validation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...
Digium Asterisk PJSIP Stack ACK Denial of Service
A denial of service vulnerability exists in Digium Asterisk when the PJSIP stack is used. The vulnerability is due to improper processing of ACKs from an unrecognized endpoint, that causes a NULL pointer dereference. A remote unauthenticated attacker can exploit this vulnerability by sending an A...
[SECURITY] [DSA 3700-1] asterisk security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3700-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 25, 2016 https://www.debian.org/security/faq -...
Debian Security Advisory DSA 3700-1 (asterisk - security update)
Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service or incorrect certificate validation. OpenVAS Vulnerability Test $Id: deb3700.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3700-1...
DSA-3700-1 asterisk - security update
Bulletin has no description...
Debian: Security Advisory (DSA-3700-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Flash Operator Panel 2.31.03 - Multiple Web Vulnerabilities
Document Title: =============== Flash Operator Panel 2.31.03 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1906 Release Date: ============= 2016-10-21 Vulnerability Laboratory ID VL-ID: ===================================...