4579 matches found
asterisk -- Multiple Vulnerabilities
Asterisk project reports: It is possible to enumerate SIP usernames when the general and user/peer NAT settings differ in whether to respond to the port a request is sent from or the port listed for responses in the Via header. When the "automon" feature is enabled in features.conf, it is possibl...
SIP Username Enumeration
The SIP server on the remote host appears to respond differently to registration requests for valid and invalid usernames. Using that fact, Nessus was able to enumerate some of the valid usernames. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
Asterisk SIP Channel Driver Uninitialized Variable Request Parsing DoS (AST-2011-012)
According to the version in its SIP banner, the version of Asterisk running on the remote host can be crashed remotely by an authenticated user when parsing an invalid SIP URI. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if descripti...
Asterisk Invalid INVITE / REGISTER SIP Request Username Enumeration (AST-2011-011)
According to the version in its SIP banner, the version of Asterisk running on the remote host allows a remote attacker to enumerate valid users by sending malformed SIP INVITE and REGISTER requests. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
Fedora 15 : asterisk-1.8.7.1-1.fc15 (2011-14538)
The Asterisk Development Team has announced a security release for Asterisk= 1.8. The available security release is released as version 1.8.7.1. This release is available for immediate download at http://downloads.asterisk.org/pub/telephony/asterisk/releases The release of Asterisk 1.8.7.1 resolv...
Cisco IOS Software and Cisco Unified Communications Manager Session Initiation Protocol Packet Processing Memory Leak Vulnerability
Cisco IOS Software and Cisco Unified Communications Manager contain a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to improper processing of malformed packets by the affected software. An unauthenticated,...
CVE-2011-0941
Memory leak in Cisco Unified Communications Manager CUCM 6.x before 6.15su2, 7.x before 7.15bsu3, 8.x before 8.03asu1, and 8.5 before 8.51, and Cisco IOS 12.4 and 15.1, allows remote attackers to cause a denial of service memory consumption and process failure or device reload via a malformed SIP...
Memory corruption
Memory leak in Cisco Unified Communications Manager CUCM 6.x before 6.15su2, 7.x before 7.15bsu3, 8.x before 8.03asu1, and 8.5 before 8.51, and Cisco IOS 12.4 and 15.1, allows remote attackers to cause a denial of service memory consumption and process failure or device reload via a malformed SIP...
CVE-2011-0941
Memory leak in Cisco Unified Communications Manager CUCM 6.x before 6.15su2, 7.x before 7.15bsu3, 8.x before 8.03asu1, and 8.5 before 8.51, and Cisco IOS 12.4 and 15.1, allows remote attackers to cause a denial of service memory consumption and process failure or device reload via a malformed SIP...
CVE-2011-0941
Cisco CUCM and Cisco IOS are affected by a memory leak vulnerability (CVE-2011-0941) triggered by malformed SIP messages. A remote attacker could cause denial of service through memory consumption, leading to process failure or device reload. Affected: CUCM 6.x before 6.1(5)su2; CUCM 7.x before 7...
AST-2011-012: Remote crash vulnerability in SIP channel driver
Asterisk Project Security Advisory - AST-2011-012 Product Asterisk Summary Remote crash vulnerability in SIP channel driver Nature of Advisory Remote crash Susceptibility Remote authenticated sessions Severity Critical Exploits Known No Reported On October 4, 2011 Reported By Ehsan Foroughi Poste...
Asterisk uninitilized memory reference
Crash on SIP request processing...
CVE-2011-4063
chansip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of service daemon crash via a malformed request...
Design/Logic Flaw
chansip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of service daemon crash via a malformed request...
CVE-2011-4063
chansip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of service daemon crash via a malformed request...
CVE-2011-4063
chansip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of service daemon crash via a malformed request...
CVE-2011-4063
CVE-2011-4063 affects Asterisk Open Source 1.8.x (before 1.8.7.1) and 10.x (before 10.0.0-rc1). The SIP channel driver (chan_sip.c) does not properly initialize variables during request parsing, allowing remote authenticated users to trigger a denial-of-service and cause the daemon to crash. Miti...
CVE-2011-4063
chansip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of service daemon crash via a malformed request...