Asterisk Pedantic模式SIP信道驱动INVITE头拒绝服务漏洞

BUGTRAQ ID: 34070 CVECAN ID: CVE-2009-0871 Asterisk是开放源码的软件PBX，支持各种VoIP协议和设备。 如果配置pedantic=yes的话，SIP信道驱动会对SIP回溯所接收到的INVITE执行额外的请求URI检查，检查中会对所发送的出站SIP INVITE头与接收到的SIP INVITE头做比较，检查代码假设所有情况下的每个头都不会为空，而实际上如果没有头的话，传送的值会为空，这可能在 sipuriparamscmp和sipuriheaderscmp函数中触发空指针引用。远程攻击者可以通过发送畸形的...

Null pointer dereference

The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service crash via a SIP INVITE request without...

CVE-2009-0871

The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service crash via a SIP INVITE request without...

CVE-2009-0871: Improper Input Validation

The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service crash via a SIP INVITE request without...

Asterisk VoIP server DoS

NULL pointer dereference on empty SIP INVITE header...

msoffice-dos.txt

!usr/bin/perl -w Microsoft Communicator allows remote attackers to cause a denial of service memory consumption via a large number of SIP INVITE requests, which trigger the creation of many sessions. Refer: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-5180...

Microsoft Office Communicator (SIP) Remote Denial of Service Exploit

Exploit for unknown platform in category dos / poc ==================================================================== Microsoft Office Communicator SIP Remote Denial of Service Exploit ==================================================================== !usr/bin/perl -w Microsoft Communicator...

Microsoft Office - Communicator SIP Remote Denial of Service

Microsoft Office - Communicator SIP Remote Denial of Service !usr/bin/perl -w Microsoft Communicator allows remote attackers to cause a denial of service memory consumption via a large number of SIP INVITE requests, which trigger the creation of many sessions. Refer:...

Code injection

Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service memory consumption via a large number of SIP INVITE requests, which trigger the creation of many sessions...

CVE-2008-5180

Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service memory consumption via a large number of SIP INVITE requests, which trigger the creation of many sessions...

CVE-2008-5180

Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service memory consumption via a large number of SIP INVITE requests, which trigger the creation of many sessions...

CVE-2008-5180

Microsoft Communicator and the Communicator component in Office 2010 beta are affected by CVE-2008-5180. The vulnerability allows remote attackers to cause a denial of service (memory consumption) by sending a large number of SIP INVITE requests, which triggers the creation of many sessions. The ...

PT-2008-6324 · Microsoft · Ge Communicator +1

Name of the Vulnerable Software and Affected Versions: Microsoft Communicator affected versions not specified Microsoft Office 2010 beta affected versions not specified Description: The issue allows remote attackers to cause a denial of service, resulting in memory consumption, via a large number...

CVE-2008-5180: Allocation of Resources Without Limits or Throttling

Microsoft Communicator, and Communicator in Microsoft Office 2010 beta, allows remote attackers to cause a denial of service memory consumption via a large number of SIP INVITE requests, which trigger the creation of many sessions...

CVE-2008-3210

rutil/dns/DnsStub.cxx in ReSIProcate 1.3.2, as used by repro, allows remote attackers to cause a denial of service daemon crash via a SIP 1 INVITE or 2 OPTIONS message with a long domain name in a request URI, which triggers an assert error...

CVE-2008-3210: Improper Input Validation

rutil/dns/DnsStub.cxx in ReSIProcate 1.3.2, as used by repro, allows remote attackers to cause a denial of service daemon crash via a SIP 1 INVITE or 2 OPTIONS message with a long domain name in a request URI, which triggers an assert error...

reSIProcate 1.3.2 Remote Denial of Service PoC

No description provided by source. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Remote DoS in reSIProcate MU-200807-01 July 10, 2008 http://labs.mudynamics.com/advisories.html Affected Products/Versions: repro SIP proxy/registrar 1.3.2 http://www.resiprocate.org/ReSIProcate1.3.2Release Any produ...

TorrentTrader多个SQL注入漏洞

BUGTRAQ ID: 29787 CVECAN ID: CVE-2008-2428 TorrentTrader是用PHP编写的torrent tracker平台。 TorrentTrader的account-signup.php文件中没有正确地验证对email和wantusername参数的输入，远程攻击者可以通过SQL注入攻击检索管理员口令哈希。成功利用这个漏洞要求禁用了magicquotesgpc且站点没有配置为invite-only。...

Null pointer dereference

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing aka pedanticsipchecking is enabled, allows remote attackers to cause a denial of service daemon crash via a SIP INVITE message that lacks a From header, related to...

CVE-2008-2119

Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing aka pedanticsipchecking is enabled, allows remote attackers to cause a denial of service daemon crash via a SIP INVITE message that lacks a From header, related to...