4016 matches found
Digium Asterisk SIP Channel Driver Denial Of Service (CVE-2011-4063)
A denial of service vulnerability has been reported in Digium Asterisk. The vulnerability is due to an error in Asterisk's SIP channel driver while handling malformed REGISTER requests. A remote attacker may exploit this vulnerability by sending a specially crafted REGISTER request to an affected...
Asterisk SIP processing security vulnerabilities
DoS, information leakage...
Exploit for Asterisk Security Advisory AST-2011-013
A Metasploit module is attached that demonstrates how to enumerate Asterisk sip peers that have a nat setting different to the global sip nat setting as described in Asterisk Security Advisory AST-2011-013. The example below finds all peers with nat=yes, but the metasploit module will also work...
SIP Username Enumerator For Asterisk
require 'msf/core' class Metasploit3 'SIP Username Enumerator for Asterisk UDP Security Advisory AST-2011-013, CVE-2011-4597', 'Version' = '$Revision: 1 $', 'Description' = 'REGISTER scan for numeric peer usernames having a nat setting different to global sip nat setting. ' 'Ben Williams',...
[SECURITY] [DSA 2367-1] asterisk security update
------------------------------------------------------------------------- Debian Security Advisory DSA-2367-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff December 19, 2011 http://www.debian.org/security/faq -...
DSA-2367-1 asterisk - several
Bulletin has no description...
CVE-2011-4597
The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series ...
DEBIAN-CVE-2011-4597
The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series ...
DEBIAN-CVE-2011-4598
The handlerequestinfo function in channels/chansip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted sequence of SIP requests...
CVE-2011-4597
The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series ...
CVE-2011-4598
The handlerequestinfo function in channels/chansip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted sequence of SIP requests...
CVE-2011-4598
The handlerequestinfo function in channels/chansip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted sequence of SIP requests...
Code injection
The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series ...
Null pointer dereference
The handlerequestinfo function in channels/chansip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted sequence of SIP requests...
CVE-2011-4597
The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series ...
CVE-2011-4598
The handlerequestinfo function in channels/chansip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted sequence of SIP requests...
CVE-2011-4598
The handlerequestinfo function in channels/chansip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted sequence of SIP requests...
CVE-2011-4597
CVE-2011-4597 affects Asterisk Open Source SIP over UDP implementations in 1.4.x up to 1.4.43, 1.6.x up to 1.6.2.21, and 1.8.x up to 1.8.7.2. The vulnerability arises from using different port numbers for responses to invalid requests based on whether a SIP username exists, enabling remote attack...
CVE-2011-4598
CVE-2011-4598 affects Asterisk Open Source 1.6.2.x (before 1.6.2.21) and 1.8.x (before 1.8.7.2). The handle_request_info function in channels/chan_sip.c can trigger a NULL pointer dereference and daemon crash when automon is enabled, via a crafted sequence of SIP requests, leading to a denial of ...
CVE-2011-4598
The handlerequestinfo function in channels/chansip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a crafted sequence of SIP requests...