Asterisk PJSIP Channel Driver Subscription DoS (AST-2014-004)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a denial of service vulnerability. A flaw exists in the PJSIP channel driver when handling 'SUBSCRIBE' requests. When Asterisk receives a 'SUBSCRIBE' request for a presence...

Asterisk PJSIP Channel Driver Options DoS (AST-2014-003)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a denial of service vulnerability. A flaw exists in the PJSIP channel driver when the 'qualityfrequency' configuration is enabled on an AOR when the SIP server's challenges fo...

Asterisk SIP File Descriptor Exhaustion with chan_sip Session-Timers DoS (AST-2014-002)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a denial of service vulnerability. A denial of service flaw exists with the SIP INVITE request handling. It is possible for a remote attacker to use all available file...

AST-2014-002: Denial of Service Through File Descriptor Exhaustion with chan_sip Session-Timers

Asterisk Project Security Advisory - AST-2014-002 Product Asterisk Summary Denial of Service Through File Descriptor Exhaustion with chansip Session-Timers Nature of Advisory Denial of Service Susceptibility Remote Authenticated or Anonymous Sessions Severity Moderate Exploits Known No Reported O...

Asterisk SIP INVITE请求处理拒绝服务漏洞

CVE ID:CVE-2014-2287 Asterisk是一款实现电话用户交换机（PBX）功能的自由软件、开源软件。 Asterisk处理特制的SIP INVITE请求时存在漏洞，由于没有正确释放文件描述符，允许远程攻击者利用漏洞提交恶意请求消耗完所有可用文件描述符，进行拒绝服务攻击。 0 Asterisk Open Source 1.8.26.0 Asterisk Open Source 11.8.0 Asterisk Open Source 12.1.0 Certified Asterisk 1.8.15-cert4 Certified Asterisk 11.6-cert1...

AST-2014-004: Remote Crash Vulnerability in PJSIP Channel Driver Subscription Handling

Asterisk Project Security Advisory - AST-2014-004 Product Asterisk Summary Remote Crash Vulnerability in PJSIP Channel Driver Subscription Handling Nature of Advisory Denial of Service Susceptibility Remote Authenticated Sessions Severity Moderate Exploits Known No Reported On January 14th, 2014...

Asterisk特制HTTP Cookie处理拒绝服务漏洞

CVE ID:CVE-2014-2286 Asterisk是一款实现电话用户交换机（PBX）功能的自由软件、开源软件。 Asterisk在处理包含大量超大cookie头的请求时存在一个溢出漏洞，允许远程攻击者利用漏洞提交恶意请求触发基于栈的溢出，可导致拒绝服务攻击。 0 Asterisk Open Source 1.8.26.0 Asterisk Open Source 11.8.0 Asterisk Open Source 12.1.0 Certified Asterisk 1.8.15-cert4 Certified Asterisk 11.6-cert1 厂商补丁： Asteris...

AST-2014-003: Remote Crash Vulnerability in PJSIP channel driver

Asterisk Project Security Advisory - AST-2014-003 Product Asterisk Summary Remote Crash Vulnerability in PJSIP channel driver Nature of Advisory Denial of Service Susceptibility Remote Unauthenticated Sessions Severity Moderate Exploits Known No Reported On January 29, 2014 Reported By Joshua Col...

Asterisk multiple security vulnerabilities

Buffer overflow, DoS...

AST-2014-001: Stack Overflow in HTTP Processing of Cookie Headers.

Asterisk Project Security Advisory - AST-2014-001 Product Asterisk Summary Stack Overflow in HTTP Processing of Cookie Headers. Nature of Advisory Denial Of Service Susceptibility Remote Unauthenticated Sessions Severity Moderate Exploits Known No Reported On February 21, 2014 Reported By Lucas...

Fonality trixbox - SQL Injection

Exploit Title: SQL injection in Trixbox All Versions Date: 13/03/2014 Exploit Author: Sc4nX Email : Sec744atyahoo.com - r1zathackermail.com Software Link: http://trixbox.org/downloads Tested on: Linux / Win 7 Example : Grab users / password hashes from ampusers� root@sc4nx python sqlmap.py -u...

FreeBSD : asterisk -- multiple vulnerabilities (03159886-a8a3-11e3-8f36-0025905a4771)

The Asterisk project reports : Stack Overflow in HTTP Processing of Cookie Headers. Sending a HTTP request that is handled by Asterisk with a large number of Cookie headers could overflow the stack. You could even exhaust memory if you sent an unlimited number of headers in the request. Denial of...

Sql injection

Multiple SQL injection vulnerabilities in the agent interface agc/ in VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allow 1 remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPTmultirecordingAJAX.php, 2 remote authenticated users to...

CVE-2013-4467

CVE-2013-4467 affects VICIdial's web interface (agent interface: agc/) and specifically the file agc/manager_send.php. The root cause is unsanitized user input used to build shell commands via PHP passthru(), enabling command execution. Affected versions include VICIdial 2.8-403a, 2.7, and 2.7RC1...

CVE-2013-4467

Multiple SQL injection vulnerabilities in the agent interface agc/ in VICIDIAL dialer aka Asterisk GUI client 2.8-403a, 2.7, 2.7RC1, and earlier allow 1 remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPTmultirecordingAJAX.php, 2 remote authenticated users to...

asterisk -- multiple vulnerabilities

The Asterisk project reports: Stack Overflow in HTTP Processing of Cookie Headers. Sending a HTTP request that is handled by Asterisk with a large number of Cookie headers could overflow the stack. You could even exhaust memory if you sent an unlimited number of headers in the request. Denial of...

Fedora Update for asterisk FEDORA-2013-24108

Check for the Version of asterisk OpenVAS Vulnerability Test Fedora Update for asterisk FEDORA-2013-24108 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Fedora Update for asterisk FEDORA-2013-24108

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GLSA-201401-15 : Asterisk: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201401-15 Asterisk: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could execute arbitrary code with t...

Asterisk: Multiple vulnerabilities

Background Asterisk is an open source telephony engine and toolkit. Description Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details. Impact A remote attacker could execute arbitrary code with the privileges of the process, caus...