Asterisk Long Contact URIs DoS Vulnerability (AST-2016-004)

Asterisk is prone to a denial of service vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk"; if...

Asterisk TLS Certificate Common Name NULL Byte Vulnerability (AST-2015-003)

Asterisk is prone to a certificate bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:digium:asterisk"; if...

asterisk -- RTP Resource Exhaustion

The Asterisk project reports: The overlap dialing feature in chansip allows chansip to report to a device that the number that has been dialed is incomplete and more digits are required. If this functionality is used with a device that has performed username/password authentication RTP resources...

asterisk -- Crash on ACK from unknown endpoint

The Asterisk project reports: Asterisk can be crashed remotely by sending an ACK to it from an endpoint username that Asterisk does not recognize. Most SIP request types result in an "artificial" endpoint being looked up, but ACKs bypass this lookup. The resulting NULL pointer results in a crash...

Digium Asterisk PJSIP Channel Driver REGISTER Denial of Service

A denial of service vulnerability exists in Digium Asterisk. The vulnerability is due to errors when processing incoming REGISTER requests with lengthy Contact Header URI. A remote authenticated attacker can exploit this vulnerability to cause a denial of service condition...

Asterisk PJProject TCP Connection DoS (AST-2016-005)

According to its SIP banner, the version of Asterisk running on the remote host is either 13.x prior to 13.8.1 or 13.1-cert prior to 13.1-cert5. It is, therefore, affected by a flaw in PJProject due to a failure to close TCP connections after receiving new ones. An unauthenticated, remote attacke...

Debian DLA-455-1 : asterisk security update

CVE-2014-6610 Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the resfaxspandsp module, allows remote authenticated users to cause a denial of service crash via an out of call message, which is not properly handled in the...

[SECURITY] [DLA 455-1] asterisk security update

Package : asterisk Version : 1:1.8.13.1dfsg1-3+deb7u4 CVE ID : CVE-2014-2286 CVE-2014-4046 CVE-2014-6610 CVE-2014-8412 CVE-2014-8418 CVE-2015-3008 Debian Bug : 741313 762164 771463 782411 CVE-2014-6610 Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6...

DLA-455-1 asterisk - security update

Bulletin has no description...

Asterisk REGISTER Request Contact URI Handling DoS (AST-2016-004)

According to its SIP banner, the version of Asterisk running on the remote host is either 13.x prior to 13.8.1 or 13.1-cert prior to 13.1-cert5. It is, therefore, affected by a flaw when processing incoming REGISTER requests if the REGISTER contains an overlong URI in the Contact header. An...

FreeBSD : PJSIP -- TCP denial of service in PJProject (e21474c6-031a-11e6-aa86-001999f8d30b)

The Asterisk project reports : PJProject has a limit on the number of TCP connections that it can accept. Furthermore, PJProject does not close TCP connections it accepts. By default, this value is approximately 60. An attacker can deplete the number of allowed TCP connections by opening TCP...

FreeBSD : asterisk -- Long Contact URIs in REGISTER requests can crash Asterisk (ee50726e-0319-11e6-aa86-001999f8d30b)

The Asterisk project reports : Asterisk may crash when processing an incoming REGISTER request if that REGISTER contains a Contact header with a lengthy URI. This crash will only happen for requests that pass authentication. Unauthenticated REGISTER requests will not result in a crash occurring...

The vulnerability of the Asterisk IP-telephony management system, as well as the Certified Asterisk IP-telephony management system, allows a perpetrator to trigger a service failure.

The vulnerability of the chansip function in IP-telephony management systems of Certified Asterisk and Asterisk is related to the setting of the timert1 sip.conf value, which exceeds 1245. Exploiting this vulnerability allows a malicious actor to cause a service failure exhaustion of file...

The vulnerability of Asterisk IP-telephony management systems and Certified Asterisk, which allows a perpetrator to trigger a service failure.

The vulnerability of Asterisk IP-telephony systems and Certified Asterisk is related to errors in pointer assignment. Exploiting this vulnerability can allow a malicious actor to cause service failures pointer assignment of an uninitialized pointer and emergency termination of operations...

Asterisk Multiple Denial of Service Vulnerabilities

Asterisk is prone to multiple denial of service DoS vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fedora 22 : asterisk-13.7.1-1.fc22 (2016-3cc13611f4)

Update to upstream 13.7.1 release for security fixes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Fedora 23 : asterisk-13.7.1-1.fc23 (2016-153eed2bb8)

Update to upstream 13.7.1 release for security fixes Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Mageia: Security Advisory (MGASA-2016-0086)

The remote host is missing an update for the SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

MGASA-2016-0086 Updated asterisk packages fix CVE-2016-2316

Updated asterisk packages fix security vulnerability: chansip in Asterisk Open Source 11.x before 11.21.1, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service file descriptor consumption via vectors related to large...

Updated asterisk packages fix CVE-2016-2316

Updated asterisk packages fix security vulnerability: chansip in Asterisk Open Source 11.x before 11.21.1, when the timert1 sip.conf configuration is set to a value greater than 1245, allows remote attackers to cause a denial of service file descriptor consumption via vectors related to large...