CVE-2009-2651: Undefined Security Weakness

main/rtp.c in Asterisk Open Source 1.6.1 before 1.6.1.2 allows remote attackers to cause a denial of service crash via an RTP text frame without a certain delimiter, which triggers a NULL pointer dereference and the subsequent calculation of an invalid pointer...

Asterisk IAX2 Resource Exhaustion via Attacked IAX Fuzzer

Exploit for multiple platform in category dos / poc ========================================================= Asterisk IAX2 Resource Exhaustion via Attacked IAX Fuzzer ========================================================= !/usr/bin/perl -w udp IAX protocol fuzzer Created: Blake Cornell Exploi...

Asterisk IAX2 - Attacked IAX Fuzzer Resource Exhaustion (Denial of Service)

Asterisk IAX2 - Attacked IAX Fuzzer Resource Exhaustion Denial of Service !/usr/bin/perl -w udp IAX protocol fuzzer Created: Blake Cornell Exploits found with this code can be found at http://www.securityscraper.com/ Released under the VoIPER project Do not hesitate to show enthusiasm and support...

Asterisk IAX2 - Attacked IAX Fuzzer Resource Exhaustion (Denial of Service)

!/usr/bin/perl -w udp IAX protocol fuzzer Created: Blake Cornell Exploits found with this code can be found at http://www.securityscraper.com/ Released under the VoIPER project Do not hesitate to show enthusiasm and support and help develop this further. use strict; use IO::Socket; use...

VICIDIAL Call Center Suite admin.php SQL Injection

The remote host is running the VICIDIAL Call Center Suite, a set of programs for Asterisk that act as a complete call center suite. The version of this software installed on the remote host fails to sanitize user-supplied input to the 'PHPAUTHUSER' and 'PHPAUTHPW' variables before using it to...

VICIDIAL Call Center Suite Default Administrative Credentials

The remote host is running the VICIDIAL Call Center Suite, a set of programs for Asterisk that act as a complete call center suite. The remote installation of VICIDIAL is configured to use default credentials to control administrative access. Knowing these, an attacker can gain administrative...

FreePBX跨站脚本和信息泄漏漏洞

Bugraq ID: 34857 CNCAN ID：CNCAN-2009050801 FreePBX是一款用来控制Asterisk的图形化接口。 FreePBX存在多个安全问题，远程攻击者可以利用漏洞获得系统敏感信息或进行跨站脚本攻击。 -reports.php脚本对"display"参数，config.php对"order"和"extdisplay"参数，recordings/index.php脚本对"sort"参数在返回用户前缺少过滤，可导致在用户浏览器会话中执行任意HTML和脚本代码。...

Gentoo Security Advisory GLSA 200905-01 (asterisk)

The remote host is missing updates announced in advisory GLSA 200905-01. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200905-01 (asterisk)

The remote host is missing updates announced in advisory GLSA 200905-01. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

GLSA-200905-01 : Asterisk: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200905-01 Asterisk: Multiple vulnerabilities Multiple vulnerabilities have been discovered in the IAX2 channel driver when performing the 3-way handshake CVE-2008-1897, when handling a large number of POKE requests CVE-2008-3263,...

Asterisk: Multiple vulnerabilities

Background Asterisk is an open source telephony engine and toolkit. Description Multiple vulnerabilities have been discovered in the IAX2 channel driver when performing the 3-way handshake CVE-2008-1897, when handling a large number of POKE requests CVE-2008-3263, when handling authentication...

Fedora 10 : asterisk-1.6.0.5-2.fc10 (2009-0984)

Add a patch to fix a problem with the manager interface. Update to 1.6.0.5 to fix AST-2009-001 / CVE-2009-0041: http://downloads.digium.com/pub/security/AST-2009-001.html Original patch in 1.6.0.3 introduced a regression. Note that Tenable Network Security has extracted the preceding description...

Asterisk VoIP server user accounts enumeration

Different replies for non-exstant SIP account and invalid password...

AST-2009-003: SIP responses expose valid usernames

Asterisk Project Security Advisory - AST-2009-003 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | SIP responses expose valid usernames |...

Asterisk认证SIP响应用户名枚举漏洞

BUGTRAQ ID: 34353 CVECAN ID: CVE-2008-3903 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 如果启用了Digest认证的话，Asterisk PBX对登录期间所尝试的有效和无效SIP用户名会返回不同的响应，远程攻击者可以通过暴力猜测枚举出有效的用户名。 Asterisk Asterisk 1.6.0.x Asterisk Asterisk 1.4.x Asterisk Asterisk 1.2.x Asterisk Business Edition C.2.x.x Asterisk Business Edition...

Asterisk Pedantic模式SIP信道驱动INVITE头拒绝服务漏洞

BUGTRAQ ID: 34070 CVECAN ID: CVE-2009-0871 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 如果配置pedantic=yes的话，SIP信道驱动会对SIP回溯所接收到的INVITE执行额外的请求URI检查，检查中会对所发送的出站SIP INVITE头与接收到的SIP INVITE头做比较，检查代码假设所有情况下的每个头都不会为空，而实际上如果没有头的话，传送的值会为空，这可能在 sipuriparamscmp和sipuriheaderscmp函数中触发空指针引用。远程攻击者可以通过发送畸形的...

CVE-2009-0871

The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service crash via a SIP INVITE request without...

CVE-2009-0871

The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service crash via a SIP INVITE request without...

Null pointer dereference

The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service crash via a SIP INVITE request without...

CVE-2009-0871

CVE-2009-0871 affects the SIP channel driver in Asterisk Open Source and Asterisk Business Edition C.2.3 when the pedantic option is enabled. Remote authenticated users can crash the system by sending a SIP INVITE without headers, triggering a NULL pointer dereference in sip_uri_headers_cmp and s...