4016 matches found
CVE-2011-2529
chansip.c in the SIP channel driver in Asterisk Open Source 1.6.x before 1.6.2.18.1 and 1.8.x before 1.8.4.3 does not properly handle '\0' characters in SIP packets, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via a crafte...
CVE-2011-2665
reqrespparser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a SIP packet with a Contact header that lacks a less than character...
CVE-2011-2536
chansip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending o...
CVE-2011-2529: Improper Restriction of Operations within the Bounds of a Memory Buffer
chansip.c in the SIP channel driver in Asterisk Open Source 1.6.x before 1.6.2.18.1 and 1.8.x before 1.8.4.3 does not properly handle '\0' characters in SIP packets, which allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via a crafte...
CVE-2011-2536: Exposure of Sensitive Information to an Unauthorized Actor
chansip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending o...
PT-2011-3921
Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.x through 1.4.41.1 Asterisk Open Source versions 1.6.2.x through 1.6.2.18.1 Asterisk Open Source versions 1.8.x through 1.8.4.3 Asterisk Business Edition C.3 through C.3.7.3 Description The issue allows remote...
PT-2011-4012
Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.8.x through 1.8.4.2 Description The issue allows remote attackers to cause a denial of service, resulting in a daemon crash, by sending a SIP packet with a Contact header that lacks a character. This is due to a...
PT-2011-3916
Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.6.x through 1.6.2.18.1 Asterisk Open Source versions 1.8.x through 1.8.4.3 Description The issue is related to the handling of '0' characters in SIP packets by the SIP channel driver. This can be exploited by...
Asterisk Remote Crash Vulnerability in Skinny Channel Driver (AST-2012-009)
Binary data 6510.prm...
CVE-2011-2666: Undefined Security Weakness
The default configuration of the SIP channel driver in Asterisk Open Source 1.4.x through 1.4.41.2 and 1.6.2.x through 1.6.2.18.2 does not enable the alwaysauthreject option, which allows remote attackers to enumerate account names by making a series of invalid SIP requests and observing the...
PT-2011-4013
Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.x through 1.4.41.2 Asterisk Open Source versions 1.6.2.x through 1.6.2.18.2 Description The default configuration of the SIP channel driver in Asterisk Open Source does not enable the alwaysauthreject option...
CVE-2011-2535: Improper Input Validation
chaniax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a deni...
PT-2011-3922
Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.x through 1.4.41.1 Asterisk Open Source versions 1.6.2.x through 1.6.2.18.1 Asterisk Open Source versions 1.8.x through 1.8.4.3 Asterisk Business Edition C.3.x through C.3.7.2 Description The issue allows remo...
CVE-2011-2665: Undefined Security Weakness
reqrespparser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service NULL pointer dereference and daemon crash via a SIP packet with a Contact header that lacks a less than character...
AST-2011-011: Possible enumeration of SIP users due to differing authentication responses
Asterisk Project Security Advisory - AST-2011-011 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | Possible enumeration of SIP users due to | | | differing...
Asterisk user account enumeration
Different replies on mismatched usernames and passwords...
Asterisk 1.8.x SIP User Enumeration
Asterisk 1.8.4.4, sip response permit username identification through use INVITE Author: francesco.tornieri "At" verona-wireless.net Summary: Sip responses permit user identification Reference: http://downloads.asterisk.org/pub/security/AST-2011-011.pdf Release Date: 30/06/2011 Criticality level:...
Asterisk Multiple Channel Drivers Denial of Service (AST-2011-008 / AST-2011-009 / AST-2011-010)
According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by multiple denial of service vulnerabilities : - If a remote user sends a SIP packet with a NULL, Asterisk reads data past the NULL even though the buffer is actually truncated...
FreeBSD : Asterisk -- multiple vulnerabilities (40544e8c-9f7b-11e0-9bec-6c626dd55a41)
The Asterisk Development Team reports : AST-2011-008: If a remote user sends a SIP packet containing a NULL, Asterisk assumes available data extends past the null to the end of the packet when the buffer is actually truncated when copied. This causes SIP header parsing to modify data past the end...