CVE-2014-8413

The CVE-2014-8413 issue affects Asterisk Open Source 12.x (before 12.7.1) and 13.x (before 13.0.1). The res_pjsip_acl module does not properly create/load ACLs defined in pjsip.conf at startup, allowing remote attackers to bypass intended PJSIP ACL rules. Impact is remote, unauthenticated access ...

CVE-2014-8412

CVE-2014-8412 affects Asterisk Open Source and Certified Asterisk: 1.8.x (before 1.8.32.1), 11.x (before 11.14.1), 12.x (before 12.7.1), 13.x (before 13.0.1); Certified Asterisk 1.8.28 (before 1.8.28-cert3) and 11.6 (before 11.6-cert8). The vulnerability is a bypass of ACL restrictions in the VoI...

CVE-2014-8416

CVE-2014-8416 is a use-after-free vulnerability in Asterisk’s PJSIP channel driver (res_pjsip_refer). The issue allows a remote attacker to crash the application via an in-dialog INVITE with a Replaces message, causing the channel to hang up. Affected products/versions stated: Asterisk Open Sourc...

CVE-2014-8414

ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service channel hang and memory consumption by causing transitions to be delayed, which triggers a state change from...

CVE-2014-8413

The respjsipacl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules...

CVE-2014-8417

ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 11.6 before 11.6-cert8 allows remote authenticated users to 1 gain privileges via vectors related to an external protocol to the CONFBRIDGE dialplan function or 2 execute arbitrary system...

CVE-2014-8414

ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service channel hang and memory consumption by causing transitions to be delayed, which triggers a state change from...

CVE-2014-8415

CVE-2014-8415 is a race condition in the chan_pjsip channel driver of Asterisk Open Source, affecting 12.x before 12.7.1 and 13.x before 13.0.1. A remote attacker can trigger a denial of service (assertion failure and crash) by sending a cancel request for a SIP session with a queued action to ei...

CVE-2014-8416

Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the respjsiprefer module, allows remote attackers to cause a denial of service crash via an in-dialog INVITE with Replaces message, which triggers the channel to ...

CVE-2014-8412

The 1 VoIP channel drivers, 2 DUNDi, and 3 Asterisk Manager Interface AMI in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass t...

CVE-2014-8418

The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protoco...

CVE-2014-8418

CVE-2014-8418 affects Asterisk Open Source: DB dialplan function allows remote authenticated users to gain privileges via a call from an external protocol (AMI). Affected: 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, 13.x before 13.0.1; Certified Asterisk 1.8.x before 1.8.28-cer...

CVE-2014-8418

The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protoco...

CVE-2014-8413

The respjsipacl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules...

CVE-2014-8417

CVE-2014-8417 affects Asterisk’s ConfBridge: remote authenticated users can escalate privileges via the external protocol to the CONFBRIDGE dialplan function or run arbitrary commands via a crafted ConfbridgeStartRecord AMI action. Affected: Asterisk 11.x pre-11.14.1, 12.x pre-12.7.1, 13.x pre-13...

CVE-2014-8414

CVE-2014-8414 affects Asterisk 11.x (before 11.14.1) and Certified Asterisk 11.6 (before 11.6-cert8). The issue arises in ConfBridge where state changes are not handled correctly, allowing remote attackers to trigger a denial of service by delaying state transitions, causing the channel to hang a...

CVE-2014-8415

Race condition in the chanpjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service assertion failure and crash via a cancel request for a SIP session with a queued action to 1 answer a session or 2 send ringing...

CVE-2014-8416

Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the respjsiprefer module, allows remote attackers to cause a denial of service crash via an in-dialog INVITE with Replaces message, which triggers the channel to ...

AST-2014-016: Remote Crash Vulnerability in PJSIP channel driver

Asterisk Project Security Advisory - AST-2014-015 Product Asterisk Summary Remote Crash Vulnerability in PJSIP channel driver Nature of Advisory Denial of Service Susceptibility Remote Unauthenticated Sessions Severity Moderate Exploits Known No Reported On 30 October 2014 Reported By Yaron Nahum...

AST-2014-014: High call load may result in hung channels in ConfBridge.

Asterisk Project Security Advisory - AST-2014-014 Product Asterisk Summary High call load may result in hung channels in ConfBridge. Nature of Advisory Denial of Service Susceptibility Remote Unauthenticated Sessions Severity Moderate Exploits Known No Reported On 19 October, 2014 Reported By Ben...