Asterisk PBX SIP DoS

Application crash on malcrafted SIP packet...

Two new DoS Vulnerabilities in Asterisk Fixed

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Digium have released fixes for two new DoS vulnerabilities in Asterisk today. Excerpt from 1.2.17: Along with minor bug fixes, this release incorporates a fix for the SIP DoS vulnerability recently discovered by INRIA Lorraine:...

CVE-2007-1561

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service crash via a SIP INVITE message with an SDP containing one valid and one invalid IP address...

Code injection

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service crash via a SIP INVITE message with an SDP containing one valid and one invalid IP address...

CVE-2007-1561

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service crash via a SIP INVITE message with an SDP containing one valid and one invalid IP address...

DEBIAN-CVE-2007-1561

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service crash via a SIP INVITE message with an SDP containing one valid and one invalid IP address...

CVE-2007-1561

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service crash via a SIP INVITE message with an SDP containing one valid and one invalid IP address...

CVE-2007-1561

CVE-2007-1561 affects the Asterisk channel driver; versions before 1.2.17 and 1.4.x before 1.4.2 are vulnerable. A remote attacker can trigger a denial of service by sending a SIP INVITE with an SDP containing one valid and one invalid IP address, causing the server to crash. Mitigations in conne...

CVE-2007-1561

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service crash via a SIP INVITE message with an SDP containing one valid and one invalid IP address...

CVE-2007-1561

The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service crash via a SIP INVITE message with an SDP containing one valid and one invalid IP address...

Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (PoC) (2)

Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow PoC 2 source: https://www.securityfocus.com/bid/23648/info Asterisk is prone to multiple remote stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data before copying it...

Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (PoC) (1)

source: https://www.securityfocus.com/bid/23648/info Asterisk is prone to multiple remote stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data before copying it to insufficiently sized buffers. Successful exploits may allow an...

Asterisk SIP Invite消息远程拒绝服务漏洞

Asterisk是一个开放源代码的软件VoIP PBX系统。 Asterisk处理INVITE消息存在问题，远程攻击者可以利用漏洞对应用程序进行拒绝服务攻击。 发送畸形的INVITE消息可导致应用程序崩溃，匿名INVITE的SDP包含2个连接头，第一个必须是合法，而第二个头数据使用非法数据，这里的IP地址必须非法，呼叫者不需要合法用户或者dialplan中的用户。asterisk设置为不允许匿名调用，合法用户和密码必须知道。 Asterisk Asterisk 1.4.1 Asterisk Asterisk 1.2.16 Asterisk Asterisk 1.2.15 Asterisk...

Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (PoC) (2)

source: https://www.securityfocus.com/bid/23648/info Asterisk is prone to multiple remote stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data before copying it to insufficiently sized buffers. Successful exploits may allow an...

Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow (PoC) (1)

Asterisk 1.4 SIP T.38 SDP - Parsing Remote Stack Buffer Overflow PoC 1 source: https://www.securityfocus.com/bid/23648/info Asterisk is prone to multiple remote stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data before copying it...

[Full-disclosure] Asterisk SDP DOS vulnerability

MADYNES Security Advisory http://madynes.loria.fr/ http://madynes.loria.fr Title: Asterisk SIP INVITE remote DOS Release Date: 08/03/2007 Severity: High - Denial of Service Advisory ID:KIPH1 Software: Asterisk http://www.asterisk.org/ http://www.asterisk.org/ AsteriskR is a complete IP PBX in...

GLSA-200703-14 : Asterisk: SIP Denial of Service

The remote host is affected by the vulnerability described in GLSA-200703-14 Asterisk: SIP Denial of Service The MU Security Research Team discovered that Asterisk contains a NULL pointer dereferencing error in the SIP channel when handling request messages. Impact : A remote attacker could cause...

Asterisk: SIP Denial of service

Background Asterisk is an open source implementation of a telephone private branch exchange PBX. Description The MU Security Research Team discovered that Asterisk contains a NULL-pointer dereferencing error in the SIP channel when handling request messages. Impact A remote attacker could cause a...

[Full-disclosure] [MU-200703-01] Remote DOS in Asterisk SIP

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Remote DOS in Asterisk SIP MU-200703-01 March 07, 2006 http://labs.musecurity.com/advisories.html Affected Products/Versions: Asterisk versions 1.2.15 and 1.4.0, and earlier versions Product Overview: http://www.asterisk.org/ "Asterisk is the most...

CVE-2007-1306

Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service crash by sending a Session Initiation Protocol SIP packet without a URI and SIP-version header, which results in a NULL pointer dereference...