CVE-2011-0495

2011-01-2000:00:00

ubuntu.com

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

0.032 Low

EPSS

Percentile

91.3%

JSON

Stack-based buffer overflow in the ast_uri_encode function in main/utils.c
in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1,
1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when
running in pedantic mode allows remote authenticated users to execute
arbitrary code via crafted caller ID data in vectors involving the (1) SIP
channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan
function.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/asterisk/+bug/705014>

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchasterisk< 1:1.6.2.5-0ubuntu1.3UNKNOWN
ubuntu10.10noarchasterisk< 1:1.6.2.7-1ubuntu1.1UNKNOWN
ubuntu11.04noarchasterisk< 1:1.6.2.9-2ubuntu2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	asterisk	< 1:1.6.2.5-0ubuntu1.3	UNKNOWN
ubuntu	10.10	noarch	asterisk	< 1:1.6.2.7-1ubuntu1.1	UNKNOWN
ubuntu	11.04	noarch	asterisk	< 1:1.6.2.9-2ubuntu2	UNKNOWN