CVE-2011-2536

chansip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending o...

CVE-2011-2665

reqrespparser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a SIP packet with a Contact header that lacks a less than character...

CVE-2011-2665

Summary: CVE-2011-2665 affects Asterisk Open Source 1.8.x prior to 1.8.4.3. The SIP channel driver’s reqresp_parser.c contains a flaw where a SIP packet with a Contact header lacking a left angle bracket (

CVE-2011-2666

CVE-2011-2666 affects Asterisk Open Source SIP channel, where the default configuration does not enable the alwaysauthreject option in the SIP channel driver. This allows remote attackers to enumerate account names by sending a series of invalid SIP requests and observing differences in responses...

CVE-2011-2529

chansip.c in the SIP channel driver in Asterisk Open Source 1.6.x before 1.6.2.18.1 and 1.8.x before 1.8.4.3 does not properly handle '\0' characters in SIP packets, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via a crafte...

CVE-2011-2529

CVE-2011-2529 affects Asterisk Open Source: chan_sip.c in the SIP channel driver fails to properly handle '\0' characters in SIP packets, allowing remote attackers to trigger memory corruption and possibly cause a denial of service (and other impact). Affected are Asterisk 1.6.x before 1.6.2.18.1...

CVE-2011-2535

CVE-2011-2535 affects Asterisk Open Source 1.4.x (before 1.4.41.1), 1.6.2.x (before 1.6.2.18.1), and 1.8.x (before 1.8.4.3), plus Asterisk Business Edition C.3 (before C.3.7.3). The flaw is in chan_iax2.c (IAX2 channel driver) where an option frame can be used to access a memory address, enabling...

CVE-2011-2536

chansip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending o...

CVE-2011-2535

chaniax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a deni...

CVE-2011-2536

chansip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending o...

CVE-2011-2536

CVE-2011-2536 (Asterisk) affects Asterisk Open Source 1.4.x < 1.4.41.2, 1.6.2.x < 1.6.2.18.2, 1.8.x < 1.8.4.4, and Asterisk Business Edition C.3.x

CVE-2011-2666

The default configuration of the SIP channel driver in Asterisk Open Source 1.4.x through 1.4.41.2 and 1.6.2.x through 1.6.2.18.2 does not enable the alwaysauthreject option, which allows remote attackers to enumerate account names by making a series of invalid SIP requests and observing the...

CVE-2011-2665

reqrespparser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a SIP packet with a Contact header that lacks a less than character...

CVE-2011-2529

chansip.c in the SIP channel driver in Asterisk Open Source 1.6.x before 1.6.2.18.1 and 1.8.x before 1.8.4.3 does not properly handle '\0' characters in SIP packets, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via a crafte...

CVE-2011-2666

The default configuration of the SIP channel driver in Asterisk Open Source 1.4.x through 1.4.41.2 and 1.6.2.x through 1.6.2.18.2 does not enable the alwaysauthreject option, which allows remote attackers to enumerate account names by making a series of invalid SIP requests and observing the...

Asterisk Remote Crash Vulnerability in Skinny Channel Driver (AST-2012-009)

Binary data 6510.prm...

Asterisk user account enumeration

Different replies on mismatched usernames and passwords...

AST-2011-011: Possible enumeration of SIP users due to differing authentication responses

Asterisk Project Security Advisory - AST-2011-011 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | Possible enumeration of SIP users due to | | | differing...

Asterisk 1.8.x SIP User Enumeration

Asterisk 1.8.4.4, sip response permit username identification through use INVITE Author: francesco.tornieri "At" verona-wireless.net Summary: Sip responses permit user identification Reference: http://downloads.asterisk.org/pub/security/AST-2011-011.pdf Release Date: 30/06/2011 Criticality level:...

Asterisk Multiple Channel Drivers Denial of Service (AST-2011-008 / AST-2011-009 / AST-2011-010)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by multiple denial of service vulnerabilities : - If a remote user sends a SIP packet with a NULL, Asterisk reads data past the NULL even though the buffer is actually truncated...