AST-2014-015: Remote Crash Vulnerability in PJSIP channel driver

Asterisk Project Security Advisory - AST-2014-015 Product Asterisk Summary Remote Crash Vulnerability in PJSIP channel driver Nature of Advisory Denial of Service Susceptibility Remote Unauthenticated Sessions Severity Moderate Exploits Known No Reported On 30 October 2014 Reported By Yaron Nahum...

CVE-2014-8413: Undefined Security Weakness

The respjsipacl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules...

PT-2014-8513

Name of the Vulnerable Software and Affected Versions Asterisk versions 11.x through 11.14.0 Asterisk versions 12.x through 12.7.0 Asterisk versions 13.x through 13.0.0 Certified Asterisk versions 11.6 through 11.6-cert7 Description The issue allows remote authenticated users to gain privileges o...

CVE-2014-8417: Undefined Security Weakness

ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 11.6 before 11.6-cert8 allows remote authenticated users to 1 gain privileges via vectors related to an external protocol to the CONFBRIDGE dialplan function or 2 execute arbitrary system...

Asterisk multiple security vulnerabilities

Restrictions bypass, privilege escalation, DoS...

AST-2014-017: Permission escalation through ConfBridge actions/dialplan functions

Asterisk Project Security Advisory - AST-2014-017 Product Asterisk Summary Permission escalation through ConfBridge actions/dialplan functions Nature of Advisory Permission Escalation Susceptibility Remote Authenticated Sessions Severity Minor Exploits Known No Reported On November 4, 2014 Report...

FreeBSD : asterisk -- Multiple vulnerabilities (7bfd797c-716d-11e4-b008-001999f8d30b)

The Asterisk project reports : AST-2014-014 - High call load may result in hung channels in ConfBridge. AST-2014-017 - Permission escalation through ConfBridge actions/dialplan functions. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin...

PT-2014-8514

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.8.x through 1.8.31 Asterisk Open Source versions 11.x through 11.1.4 Asterisk Open Source versions 12.x through 12.7.0 Asterisk Open Source versions 13.x through 13.0.0 Certified Asterisk versions 1.8.x through...

CVE-2014-8414: Undefined Security Weakness

ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service channel hang and memory consumption by causing transitions to be delayed, which triggers a state change from...

CVE-2014-8412: Undefined Security Weakness

The 1 VoIP channel drivers, 2 DUNDi, and 3 Asterisk Manager Interface AMI in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass t...

CVE-2014-8415: Improper Input Validation

Race condition in the chanpjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service assertion failure and crash via a cancel request for a SIP session with a queued action to 1 answer a session or 2 send ringing...

CVE-2014-8418: Undefined Security Weakness

The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protoco...

Mandriva Linux Security Advisory : asterisk (MDVSA-2014:218)

Multiple vulnerabilities has been discovered and corrected in asterisk : Remote crash when handling out of call message in certain dialplan configurations CVE-2014-6610. Asterisk Susceptibility to POODLE Vulnerability CVE-2014-3566. Mixed IP address families in access control lists may permit...

GLSA-201411-10 : Asterisk: Multiple Vulnerabilities (POODLE)

The remote host is affected by the vulnerability described in GLSA-201411-10 Asterisk: Multiple Vulnerabilities Multiple unspecified vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could exploit the...

PT-2014-8511

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 12.x through 12.7.0 Asterisk Open Source versions 13.x through 13.0.0 Description A race condition exists in the chan pjsip channel driver, allowing remote attackers to cause a denial of service via a cancel reque...

PT-2014-8510

Name of the Vulnerable Software and Affected Versions Asterisk versions 11.x through 11.14.0 Asterisk Certified versions 11.6 through 11.6-cert7 Description The issue allows remote attackers to cause a denial of service, resulting in channel hang and memory consumption. This occurs when state...

CVE-2014-8416: Improper Input Validation

Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the respjsiprefer module, allows remote attackers to cause a denial of service crash via an in-dialog INVITE with Replaces message, which triggers the channel to ...

PT-2014-8509

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 12.x through 12.7.0 Asterisk Open Source versions 13.x through 13.0.0 Description The issue concerns the res pjsip acl module, which fails to properly create and load ACLs defined in pjsip.conf at startup. This...

PT-2014-8508

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.8.x through 1.8.31, 11.x through 11.13, 12.x through 12.6, and 13.x through 13.0.0 Asterisk Open Source version 1.8.28-cert2 and earlier Asterisk Open Source version 11.6-cert7 and earlier Certified Asterisk...

AST-2014-012: Mixed IP address families in access control lists may permit unwanted traffic.

Asterisk Project Security Advisory - AST-2014-012 Product Asterisk Summary Mixed IP address families in access control lists may permit unwanted traffic. Nature of Advisory Unauthorized Access Susceptibility Remote unauthenticated sessions Severity Moderate Exploits Known No Reported On 25 Octobe...