CVE-2011-0495

Stack-based buffer overflow in the asturiencode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary...

CVE-2011-0495

Stack-based buffer overflow in the asturiencode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary...

CVE-2011-0495

CVE-2011-0495 affects Asterisk Open Source prior to the fixed versions listed in multiple advisories. The issue is a stack-based buffer overflow in ast_uri_encode in main/utils.c that can be triggered by crafted caller ID data and exploited via (1) SIP channel driver, (2) URIENCODE dialplan funct...

PT-2011-2394

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions prior to 1.4.38.1 Asterisk Open Source versions prior to 1.4.39.1 Asterisk Open Source versions prior to 1.6.1.21 Asterisk Open Source versions prior to 1.6.2.15.1 Asterisk Open Source versions prior to 1.6.2.16.1...

FreeBSD : asterisk -- Exploitable Stack Buffer Overflow (5ab9fb2a-23a5-11e0-a835-0003ba02bf30)

The Asterisk Development Team reports : The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefull...

CVE-2011-0495: Out-of-bounds Write

Stack-based buffer overflow in the asturiencode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary...

Asterisk buffer overflow

Buffer overflow in SIP Caller ID...

AST-2011-001: Stack buffer overflow in SIP channel driver

Asterisk Project Security Advisory - AST-2011-001 Product Asterisk Summary Stack buffer overflow in SIP channel driver Nature of Advisory Exploitable Stack Buffer Overflow Susceptibility Remote Authenticated Sessions Severity Moderate Exploits Known No Reported On January 11, 2011 Reported By...

asterisk -- Exploitable Stack Buffer Overflow

The Asterisk Development Team reports: The releases of Asterisk 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.2, 1.8.1.2, and 1.8.2.1 resolve an issue when forming an outgoing SIP request while in pedantic mode, which can cause a stack buffer to be made to overflow if supplied with carefully...

Elastix Cross Site Scripting

Oh look I think bugtraq hates me .... more lame xss in yet another voip management user interface for asterisk... ---------- Forwarded message ---------- From: dave b Date: 29 October 2010 03:36 Subject: xss in elastix To: [email protected] xss in elastixhttp://www.elastix.org/ , 1...

FreePBX Detection

The remote web server hosts FreePBX, an open source Asterisk management application written in PHP. C Tenable, Inc. include"compat.inc"; if description scriptid49997; scriptversion"1.11"; scriptsetattributeattribute:"pluginmodificationdate", value:"2026/02/05"; scriptnameenglish:"FreePBX...

Asterisk Trixbox CE Cross Site Scripting

The asterisk phonebook module found in trixbox CE is vulnerable to an xss which can be triggered by importing a contact from a csv file like this: "/alertdocument.cookie;";123123123;12313 FATAL ERROR url is $ip/admin/config.php?type=tool&display=phonebook So an import of a csv file which may...

FreePBX <= 2.8.0 Recordings Interface Allows Remote Code Execution

Exploit for php platform in category web applications ================================================================== FreePBX = 2.8.0 Recordings Interface Allows Remote Code Execution ================================================================== Vendor: FreePBX http://www.freepbx.org/...

Digium Asterisk Multiple Products IAX2 Handshake Denial of Service (CVE-2008-1897)

There exists a denial of service vulnerability in multiple Digium Asterisk products. The vulnerability is due to insufficient verification of ACK responses during IAX2 handshakes by the IAX2 protocol. A remote unauthenticated attacker may exploit this vulnerability by sending a crafted message to...

Asterisk Recording Interface Cross Site Request Forgery / Cross Site Scripting / Denial Of Service / Local File Inclusion

Found By: TurboBorland Email: [email protected] Software: Asterisk Recording Interface Date Found: 07/01/2010 Ethical Disclosure: Site down, no other location for project, author can not be found, no one to get in touch with. Submission. Vulnerabilities: LFI steal voicemail only need to supply...

Asterisk Recording Interface 0.7.15/0.10 - Multiple Vulnerabilities

source: https://www.securityfocus.com/bid/41571/info The Asterisk Recording Interface is prone to the following issues: 1. Multiple security bypass vulnerabilities. 2. A cross-site request-forgery vulnerability. 3. A cross-site scripting vulnerability. Attackers can exploit these issues to steal...

Asterisk Recording Interface 0.7.150.10 - Multiple Vulnerabilities

Asterisk Recording Interface 0.7.150.10 - Multiple Vulnerabilities source: https://www.securityfocus.com/bid/41571/info The Asterisk Recording Interface is prone to the following issues: 1. Multiple security bypass vulnerabilities. 2. A cross-site request-forgery vulnerability. 3. A cross-site...

Fedora 11 : asterisk-1.6.1.17-1.fc11 (2010-3724)

Update to 1.6.1.17 AST-2010-003: Invalid parsing of ACL rules can compromise security AST-2010-002: This security release is intended to raise awareness of how it is possible to insert malicious strings into dialplans, and to advise developers to read the best practices documents so that they may...

Fedora 12 : asterisk-1.6.1.17-1.fc12 (2010-3381)

Update to 1.6.1.17 AST-2010-003: Invalid parsing of ACL rules can compromise security AST-2010-002: This security release is intended to raise awareness of how it is possible to insert malicious strings into dialplans, and to advise developers to read the best practices documents so that they may...

GLSA-201006-20 : Asterisk: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201006-20 Asterisk: Multiple vulnerabilities Multiple vulnerabilities have been reported in Asterisk: Nick Baggott reported that Asterisk does not properly process overly long ASCII strings in various packets CVE-2009-2726. Noam...