Asterisk SDP Offer DoS Vulnerability (AST-2016-008)

Asterisk is prone to a SDP offer denial of service DoS vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

asterisk -- Authentication Bypass

The Asterisk project reports: The chansip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable...

asterisk -- Crash on SDP offer or answer from endpoint using Opus

The Asterisk project reports: If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the...

Digium Asterisk Denial of Service Vulnerability

Digium Asterisk is a set of open source telephone exchange PBX system software from Digium, USA. The software supports voicemail, multi-party voice conferencing, interactive voice response IVR and so on. A security vulnerability exists in Digium Asterisk. An attacker could exploit the vulnerabili...

Digium Asterisk PJSIP Stack ACK Denial of Service

A denial of service vulnerability exists in Digium Asterisk when the PJSIP stack is used. The vulnerability is due to improper processing of ACKs from an unrecognized endpoint, that causes a NULL pointer dereference. A remote unauthenticated attacker can exploit this vulnerability by sending an A...

Debian DSA-3700-1 : asterisk - security update

Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service or incorrect certificate validation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracte...

[SECURITY] [DSA 3700-1] asterisk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3700-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 25, 2016 https://www.debian.org/security/faq -...

PT-2017-9222

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 11.x through 11.23.0 Asterisk Open Source versions 13.x through 13.11.0 Certified Asterisk versions 11.6 through 11.6-cert14 Certified Asterisk versions 13.8 through 13.8-cert2 Description The issue allows remote...

Debian Security Advisory DSA 3700-1 (asterisk - security update)

Multiple vulnerabilities have been discovered in Asterisk, an open source PBX and telephony toolkit, which may result in denial of service or incorrect certificate validation. OpenVAS Vulnerability Test $Id: deb3700.nasl 6608 2017-07-07 12:05:05Z cfischer $ Auto-generated from advisory DSA 3700-1...

DSA-3700-1 asterisk - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3700-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Flash Operator Panel 2.31.03 - Multiple Web Vulnerabilities

Document Title: =============== Flash Operator Panel 2.31.03 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1906 Release Date: ============= 2016-10-21 Vulnerability Laboratory ID VL-ID: ===================================...

Flash Operator Panel 2.31.03 - Multiple Web Vulnerabilities

Document Title: =============== Flash Operator Panel 2.31.03 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1906 Release Date: ============= 2016-10-20 Vulnerability Laboratory ID VL-ID: ===================================...

MGASA-2016-0344 Updated asterisk packages fixes security vulnerability

The overlap dialing feature in chansip allows chansip to report to a device that the number that has been dialed is incomplete and more digits are required. If this functionality is used with a device that has performed username/password authentication RTP resources are leaked. This occurs becaus...

Updated asterisk packages fixes security vulnerability

The overlap dialing feature in chansip allows chansip to report to a device that the number that has been dialed is incomplete and more digits are required. If this functionality is used with a device that has performed username/password authentication RTP resources are leaked. This occurs becaus...

Flash Operator Panel 2.31.03 Script Insertion

Document Title: =============== Flash Operator Panel 2.31.03 - CSV Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1908 Release Date: ============= 2016-10-05 Vulnerability Laboratory ID VL-ID: ===================================...

Flash Operator Panel 2.31.03 - CSV Persistent Vulnerability

Document Title: =============== Flash Operator Panel 2.31.03 - CSV Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1908 Release Date: ============= 2016-10-05 Vulnerability Laboratory ID VL-ID: ===================================...

FreePBX Remote Command Execution Vulnerability (CNVD-2016-08542)

FreePBX formerly known as Asterisk Management Portal is a set of tools from the FreePBX project for configuring Asterisk IP telephony system through a GUI web-based graphical interface. A remote command execution vulnerability exists in the FreePBX 'admin/modules/hotelwakeup/Hotelwakeup.class.php...

Asterisk 13.10.x < 13.11.1 ACK Handling Unrecognized Username NULL Pointer Dereference DoS (AST-2016-006)

According to its SIP banner, the version of Asterisk running on the remote host is 13.10.x prior to 13.11.1. It is, therefore, affected by a NULL pointer dereference flaw due to improper handling of ACK packets from an unknown username. An unauthenticated, remote attacker can exploit this to cras...

Asterisk chan_sip Overlap Dialing Feature DoS (AST-2016-007)

According to its SIP banner, the version of Asterisk running on the remote host is 11.x prior to 11.23.1, 13.x prior to 13.11.1, 11.6-certx prior to 11.6-cert15, or 13.8-certx prior to 13.8-cert3. It is, therefore, affected by a flaw in the overlap dialing feature in chansip due to a failure to...