| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| url |
VCID-1qv8-5g7m-9faq |
| vulnerability_id |
VCID-1qv8-5g7m-9faq |
| summary |
In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2017-14098
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1qv8-5g7m-9faq |
|
| 4 |
|
| 5 |
| url |
VCID-23bk-txpw-dugx |
| vulnerability_id |
VCID-23bk-txpw-dugx |
| summary |
Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13-cert3 because of a buffer overflow in a CDR user field, related to X-ClientCode in chan_sip, the CDR dialplan function, and the AMI Monitor action. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2017-7617
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-23bk-txpw-dugx |
|
| 6 |
| url |
VCID-27vm-xs6e-qbcu |
| vulnerability_id |
VCID-27vm-xs6e-qbcu |
| summary |
chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of service (daemon crash) via a malformed request. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-4063
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-27vm-xs6e-qbcu |
|
| 7 |
|
| 8 |
|
| 9 |
| url |
VCID-2gyd-ta4s-nuhq |
| vulnerability_id |
VCID-2gyd-ta4s-nuhq |
| summary |
chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by closing a connection in off-hook mode. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-2948
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2gyd-ta4s-nuhq |
|
| 10 |
|
| 11 |
|
| 12 |
| url |
VCID-2xxf-t9ck-a7dj |
| vulnerability_id |
VCID-2xxf-t9ck-a7dj |
| summary |
Integer overflow in the get_input function in the Skinny channel driver (chan_skinny.c) in Asterisk 1.0.x before 1.0.12 and 1.2.x before 1.2.13, as used by Cisco SCCP phones, allows remote attackers to execute arbitrary code via a certain dlen value that passes a signed integer comparison and leads to a heap-based buffer overflow. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2006-5444
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2xxf-t9ck-a7dj |
|
| 13 |
| url |
VCID-2z7b-d497-jbb6 |
| vulnerability_id |
VCID-2z7b-d497-jbb6 |
| summary |
The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (traffic amplification) via an IAX2 FWDOWNL request. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2008-3264
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2z7b-d497-jbb6 |
|
| 14 |
| url |
VCID-2znv-h5e5-83ba |
| vulnerability_id |
VCID-2znv-h5e5-83ba |
| summary |
chan_sip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-2536
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2znv-h5e5-83ba |
|
| 15 |
|
| 16 |
|
| 17 |
| url |
VCID-3j5q-cg6c-37ca |
| vulnerability_id |
VCID-3j5q-cg6c-37ca |
| summary |
The default configuration of the SIP channel driver in Asterisk Open Source 1.4.x through 1.4.41.2 and 1.6.2.x through 1.6.2.18.2 does not enable the alwaysauthreject option, which allows remote attackers to enumerate account names by making a series of invalid SIP requests and observing the differences in the responses for different usernames, a different vulnerability than CVE-2011-2536. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-2666
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3j5q-cg6c-37ca |
|
| 18 |
| url |
VCID-3qtt-h73s-afed |
| vulnerability_id |
VCID-3qtt-h73s-afed |
| summary |
chan_iax2.c in the IAX2 channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1, when a certain mohinterpret setting is enabled, allows remote attackers to cause a denial of service (daemon crash) by placing a call on hold. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-2947
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3qtt-h73s-afed |
|
| 19 |
|
| 20 |
|
| 21 |
| url |
VCID-4278-jnsa-byd6 |
| vulnerability_id |
VCID-4278-jnsa-byd6 |
| summary |
The channel driver in Asterisk before 1.2.17 and 1.4.x before 1.4.2 allows remote attackers to cause a denial of service (crash) via a SIP INVITE message with an SDP containing one valid and one invalid IP address. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-1561
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4278-jnsa-byd6 |
|
| 22 |
|
| 23 |
| url |
VCID-4fy9-fsdz-vydu |
| vulnerability_id |
VCID-4fy9-fsdz-vydu |
| summary |
ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service (channel hang and memory consumption) by causing transitions to be delayed, which triggers a state change from hung up to waiting for media. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-8414
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4fy9-fsdz-vydu |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
| url |
VCID-58dv-5kdf-nka1 |
| vulnerability_id |
VCID-58dv-5kdf-nka1 |
| summary |
An issue was discovered in Asterisk Open Source 13.12.x and 13.13.x before 13.13.1 and 14.x before 14.2.1. If an SDP offer or answer is received with the Opus codec and with the format parameters separated using a space the code responsible for parsing will recursively call itself until it crashes. This occurs as the code does not properly handle spaces separating the parameters. This does NOT require the endpoint to have Opus configured in Asterisk. This also does not require the endpoint to be authenticated. If guest is enabled for chan_sip or anonymous in chan_pjsip an SDP offer or answer is still processed and the crash occurs. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2016-9937
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-58dv-5kdf-nka1 |
|
| 28 |
|
| 29 |
| url |
VCID-5myw-m4jg-1few |
| vulnerability_id |
VCID-5myw-m4jg-1few |
| summary |
Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2008-2119
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5myw-m4jg-1few |
|
| 30 |
|
| 31 |
| url |
VCID-5z33-txfx-6bce |
| vulnerability_id |
VCID-5z33-txfx-6bce |
| summary |
Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial of service (file descriptor exhaustion and disk space exhaustion) via a series of TCP connections. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-1507
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5z33-txfx-6bce |
|
| 32 |
| url |
VCID-62kq-8qcn-yba6 |
| vulnerability_id |
VCID-62kq-8qcn-yba6 |
| summary |
The Manager Interface in Asterisk before 1.2.18 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (crash) by using MD5 authentication to authenticate a user that does not have a password defined in manager.conf, resulting in a NULL pointer dereference. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-2294
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-62kq-8qcn-yba6 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
| url |
VCID-6f27-bqb3-1bg5 |
| vulnerability_id |
VCID-6f27-bqb3-1bg5 |
| summary |
The Asterisk Extension Language (AEL) in pbx/pbx_ael.c in Asterisk does not properly generate extensions, which allows remote attackers to execute arbitrary extensions and have an unknown impact by specifying an invalid extension in a certain form. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-1595
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6f27-bqb3-1bg5 |
|
| 37 |
| url |
VCID-6f8u-n8g1-nyeg |
| vulnerability_id |
VCID-6f8u-n8g1-nyeg |
| summary |
Asterisk Open Source 1.2.x before 1.2.26 and 1.4.x before 1.4.16, and Business Edition B.x.x before B.2.3.6 and C.x.x before C.1.0-beta8, when using database-based registrations ("realtime") and host-based authentication, does not check the IP address when the username is correct and there is no password, which allows remote attackers to bypass authentication using a valid username. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-6430
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6f8u-n8g1-nyeg |
|
| 38 |
|
| 39 |
| url |
VCID-6qrf-j2tj-pkbg |
| vulnerability_id |
VCID-6qrf-j2tj-pkbg |
| summary |
The handle_request_info function in channels/chan_sip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted sequence of SIP requests. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-4598
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6qrf-j2tj-pkbg |
|
| 40 |
| url |
VCID-6swb-auc8-pygr |
| vulnerability_id |
VCID-6swb-auc8-pygr |
| summary |
reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a SIP packet with a Contact header that lacks a < (less than) character. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-2665
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6swb-auc8-pygr |
|
| 41 |
|
| 42 |
| url |
VCID-7bc7-k654-akby |
| vulnerability_id |
VCID-7bc7-k654-akby |
| summary |
Asterisk 1.4 before 1.4.1 and 1.2 before 1.2.16 allows remote attackers to cause a denial of service (crash) by sending a Session Initiation Protocol (SIP) packet without a URI and SIP-version header, which results in a NULL pointer dereference. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-1306
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7bc7-k654-akby |
|
| 43 |
| url |
VCID-7r1a-5ar4-jfcf |
| vulnerability_id |
VCID-7r1a-5ar4-jfcf |
| summary |
Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-4047
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7r1a-5ar4-jfcf |
|
| 44 |
|
| 45 |
| url |
VCID-8e1f-41mn-3bh4 |
| vulnerability_id |
VCID-8e1f-41mn-3bh4 |
| summary |
chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SDP message with a crypto attribute and a (1) video or (2) text media type, as demonstrated by CSipSimple. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-0885
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8e1f-41mn-3bh4 |
|
| 46 |
|
| 47 |
| url |
VCID-8j3f-r3ze-yygu |
| vulnerability_id |
VCID-8j3f-r3ze-yygu |
| summary |
The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminating a subscription request before it is complete, which triggers a SIP transaction timeout. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-4048
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8j3f-r3ze-yygu |
|
| 48 |
| url |
VCID-8t58-6hnp-dyhh |
| vulnerability_id |
VCID-8t58-6hnp-dyhh |
| summary |
Asterisk Open Source 1.2.26 through 1.2.30.3 and Business Edition B.2.3.5 through B.2.5.5, when realtime IAX2 users are enabled, allows remote attackers to cause a denial of service (crash) via authentication attempts involving (1) an unknown user or (2) a user using hostname matching. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2008-5558
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8t58-6hnp-dyhh |
|
| 49 |
|
| 50 |
| url |
VCID-8zwv-ea4b-1kgr |
| vulnerability_id |
VCID-8zwv-ea4b-1kgr |
| summary |
An issue was discovered in Asterisk Open Source 15.x before 15.4.1. When connected to Asterisk via TCP/TLS, if the client abruptly disconnects, or sends a specially crafted message, then Asterisk gets caught in an infinite loop while trying to read the data stream. This renders the system unusable. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2018-12228
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8zwv-ea4b-1kgr |
|
| 51 |
| url |
VCID-93p3-29pk-kkhm |
| vulnerability_id |
VCID-93p3-29pk-kkhm |
| summary |
Multiple stack-based and heap-based buffer overflows in the (1) decode_open_type and (2) udptl_rx_packet functions in main/udptl.c in Asterisk Open Source 1.4.x before 1.4.39.2, 1.6.1.x before 1.6.1.22, 1.6.2.x before 1.6.2.16.2, and 1.8 before 1.8.2.4; Business Edition C.x.x before C.3.6.3; AsteriskNOW 1.5; and s800i (Asterisk Appliance), when T.38 support is enabled, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDPTL packet. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-1147
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-93p3-29pk-kkhm |
|
| 52 |
| url |
VCID-9a88-mws1-k3dk |
| vulnerability_id |
VCID-9a88-mws1-k3dk |
| summary |
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-6610
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9a88-mws1-k3dk |
|
| 53 |
| url |
VCID-9bs1-zeq7-jfaa |
| vulnerability_id |
VCID-9bs1-zeq7-jfaa |
| summary |
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-1184
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9bs1-zeq7-jfaa |
|
| 54 |
|
| 55 |
|
| 56 |
| url |
VCID-9r8k-em1c-rbep |
| vulnerability_id |
VCID-9r8k-em1c-rbep |
| summary |
An issue was discovered in Asterisk 13.18.4 and older, 14.7.4 and older, 15.1.4 and older, and 13.18-cert1 and older. A select set of SIP messages create a dialog in Asterisk. Those SIP messages must contain a contact header. For those messages, if the header was not present and the PJSIP channel driver was used, Asterisk would crash. The severity of this vulnerability is somewhat mitigated if authentication is enabled. If authentication is enabled, a user would have to first be authorized before reaching the crash point. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2017-17850
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9r8k-em1c-rbep |
|
| 57 |
| url |
VCID-9t5p-up39-2qcs |
| vulnerability_id |
VCID-9t5p-up39-2qcs |
| summary |
SQL injection vulnerability in the Call Detail Record Postgres logging engine (cdr_pgsql) in Asterisk 1.4.x before 1.4.15, 1.2.x before 1.2.25, B.x before B.2.3.4, and C.x before C.1.0-beta6 allows remote authenticated users to execute arbitrary SQL commands via (1) ANI and (2) DNIS arguments. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-6170
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-9t5p-up39-2qcs |
|
| 58 |
|
| 59 |
|
| 60 |
|
| 61 |
|
| 62 |
|
| 63 |
| url |
VCID-and4-m6yw-yua9 |
| vulnerability_id |
VCID-and4-m6yw-yua9 |
| summary |
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, SIP requests of the type MESSAGE (RFC 3428) authentication do not get proper alignment. An authenticated attacker can spoof any user identity to send spam messages to the user with their authorization token. Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-47779
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-and4-m6yw-yua9 |
|
| 64 |
| url |
VCID-aqzr-xqpk-83fw |
| vulnerability_id |
VCID-aqzr-xqpk-83fw |
| summary |
A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions. Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-1131
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-aqzr-xqpk-83fw |
|
| 65 |
| url |
VCID-ar64-v7yh-fug4 |
| vulnerability_id |
VCID-ar64-v7yh-fug4 |
| summary |
The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, and C.x.x before C.1.10.3; AsteriskNOW; Appliance Developer Kit 0.x.x; and s800i 1.0.x before 1.2.0.1 allows remote attackers to cause a denial of service (call-number exhaustion and CPU consumption) by quickly sending a large number of IAX2 (IAX) POKE requests. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2008-3263
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ar64-v7yh-fug4 |
|
| 66 |
|
| 67 |
|
| 68 |
| url |
VCID-bbsx-hjxg-nybm |
| vulnerability_id |
VCID-bbsx-hjxg-nybm |
| summary |
chan_sip.c in the SIP channel driver in Asterisk Open Source 1.6.x before 1.6.2.18.1 and 1.8.x before 1.8.4.3 does not properly handle '\0' characters in SIP packets, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted packet. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-2529
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bbsx-hjxg-nybm |
|
| 69 |
| url |
VCID-bh15-8qwt-b7fp |
| vulnerability_id |
VCID-bh15-8qwt-b7fp |
| summary |
main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-2414
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bh15-8qwt-b7fp |
|
| 70 |
|
| 71 |
|
| 72 |
| url |
VCID-bqyw-wjb9-w3b4 |
| vulnerability_id |
VCID-bqyw-wjb9-w3b4 |
| summary |
An issue was discovered in Asterisk Open Source 13.x before 13.37.1, 16.x before 16.14.1, 17.x before 17.8.1, and 18.x before 18.0.1 and Certified Asterisk before 16.8-cert5. If Asterisk is challenged on an outbound INVITE and the nonce is changed in each response, Asterisk will continually send INVITEs in a loop. This causes Asterisk to consume more and more memory since the transaction will never terminate (even if the call is hung up), ultimately leading to a restart or shutdown of Asterisk. Outbound authentication must be configured on the endpoint for this to occur. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2020-28242
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bqyw-wjb9-w3b4 |
|
| 73 |
| url |
VCID-bv4k-ectn-2bga |
| vulnerability_id |
VCID-bv4k-ectn-2bga |
| summary |
chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4, when the trustrpid option is enabled, allows remote authenticated users to cause a denial of service (daemon crash) by sending a SIP UPDATE message that triggers a connected-line update attempt without an associated channel. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-2416
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bv4k-ectn-2bga |
|
| 74 |
|
| 75 |
|
| 76 |
|
| 77 |
| url |
VCID-cf97-dgaw-a7ft |
| vulnerability_id |
VCID-cf97-dgaw-a7ft |
| summary |
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-1175
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cf97-dgaw-a7ft |
|
| 78 |
|
| 79 |
| url |
VCID-cr6q-j8r8-aycs |
| vulnerability_id |
VCID-cr6q-j8r8-aycs |
| summary |
chan_iax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted frame. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-2535
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cr6q-j8r8-aycs |
|
| 80 |
| url |
VCID-d23v-361c-kfhj |
| vulnerability_id |
VCID-d23v-361c-kfhj |
| summary |
The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed NEW message. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2008-1923
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-d23v-361c-kfhj |
|
| 81 |
| url |
VCID-d9ww-rj4r-tkh6 |
| vulnerability_id |
VCID-d9ww-rj4r-tkh6 |
| summary |
ConfBridge in Asterisk 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 11.6 before 11.6-cert8 allows remote authenticated users to (1) gain privileges via vectors related to an external protocol to the CONFBRIDGE dialplan function or (2) execute arbitrary system commands via a crafted ConfbridgeStartRecord AMI action. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-8417
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-d9ww-rj4r-tkh6 |
|
| 82 |
|
| 83 |
|
| 84 |
|
| 85 |
|
| 86 |
| url |
VCID-dzse-tta6-nuex |
| vulnerability_id |
VCID-dzse-tta6-nuex |
| summary |
An issue was discovered in Asterisk Open Source 11.x before 11.25.1, 13.x before 13.13.1, and 14.x before 14.2.1 and Certified Asterisk 11.x before 11.6-cert16 and 13.x before 13.8-cert4. The chan_sip channel driver has a liberal definition for whitespace when attempting to strip the content between a SIP header name and a colon character. Rather than following RFC 3261 and stripping only spaces and horizontal tabs, Asterisk treats any non-printable ASCII character as if it were whitespace. This means that headers such as Contact\x01: will be seen as a valid Contact header. This mostly does not pose a problem until Asterisk is placed in tandem with an authenticating SIP proxy. In such a case, a crafty combination of valid and invalid To headers can cause a proxy to allow an INVITE request into Asterisk without authentication since it believes the request is an in-dialog request. However, because of the bug described above, the request will look like an out-of-dialog request to Asterisk. Asterisk will then process the request as a new call. The result is that Asterisk can process calls from unvetted sources without any authentication. If you do not use a proxy for authentication, then this issue does not affect you. If your proxy is dialog-aware (meaning that the proxy keeps track of what dialogs are currently valid), then this issue does not affect you. If you use chan_pjsip instead of chan_sip, then this issue does not affect you. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2016-9938
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dzse-tta6-nuex |
|
| 87 |
|
| 88 |
| url |
VCID-e918-vkmk-h7gu |
| vulnerability_id |
VCID-e918-vkmk-h7gu |
| summary |
rtp.c in Asterisk Open Source 1.2.x before 1.2.37, 1.4.x before 1.4.27.1, 1.6.0.x before 1.6.0.19, and 1.6.1.x before 1.6.1.11; Business Edition B.x.x before B.2.5.13, C.2.x.x before C.2.4.6, and C.3.x.x before C.3.2.3; and s800i 1.3.x before 1.3.0.6 allows remote attackers to cause a denial of service (daemon crash) via an RTP comfort noise payload with a long data length. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2009-4055
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-e918-vkmk-h7gu |
|
| 89 |
| url |
VCID-eek3-jw4a-mkhh |
| vulnerability_id |
VCID-eek3-jw4a-mkhh |
| summary |
The Skinny channel driver (chan_skinny) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a certain data length value in a crafted packet, which results in an "overly large memcpy." |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-3764
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-eek3-jw4a-mkhh |
|
| 90 |
| url |
VCID-emr1-3t75-ekg4 |
| vulnerability_id |
VCID-emr1-3t75-ekg4 |
| summary |
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a provisional response to a SIP reINVITE request, which allows remote authenticated users to cause a denial of service (RTP port exhaustion) via sessions that lack final responses. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-3863
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-emr1-3t75-ekg4 |
|
| 91 |
|
| 92 |
| url |
VCID-g9s9-6kbt-qba4 |
| vulnerability_id |
VCID-g9s9-6kbt-qba4 |
| summary |
Stack-based buffer overflow in the function that parses commands in Asterisk 1.0.7, when the 'write = command' option is enabled, allows remote attackers to execute arbitrary code via a command that has two double quotes followed by a tab character. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2005-2081
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-g9s9-6kbt-qba4 |
|
| 93 |
|
| 94 |
|
| 95 |
|
| 96 |
|
| 97 |
| url |
VCID-hfmb-gc77-7fav |
| vulnerability_id |
VCID-hfmb-gc77-7fav |
| summary |
Buffer overflow in the get_msg_text of chan_sip.c in the Session Initiation Protocol (SIP) protocol implementation for Asterisk releases before August 15, 2003, allows remote attackers to execute arbitrary code via certain (1) MESSAGE or (2) INFO requests. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2003-0761
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hfmb-gc77-7fav |
|
| 98 |
|
| 99 |
| url |
VCID-hp5t-h99v-mfc1 |
| vulnerability_id |
VCID-hp5t-h99v-mfc1 |
| summary |
reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.2 does not initialize certain strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed Contact header. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-2216
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hp5t-h99v-mfc1 |
|
| 100 |
|
| 101 |
| url |
VCID-hv7y-fc1a-a7am |
| vulnerability_id |
VCID-hv7y-fc1a-a7am |
| summary |
The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when sub_min_expiry is set to zero, allows remote attackers to cause a denial of service (assertion failure and crash) via an unsubscribe request when not subscribed to the device. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-4045
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hv7y-fc1a-a7am |
|
| 102 |
| url |
VCID-j2vq-egp3-bybh |
| vulnerability_id |
VCID-j2vq-egp3-bybh |
| summary |
A Remote Crash issue was discovered in Asterisk Open Source 13.x before 13.18.4, 14.x before 14.7.4, and 15.x before 15.1.4 and Certified Asterisk before 13.13-cert9. Certain compound RTCP packets cause a crash in the RTCP Stack. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2017-17664
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-j2vq-egp3-bybh |
|
| 103 |
|
| 104 |
| url |
VCID-j6re-kvf8-h3et |
| vulnerability_id |
VCID-j6re-kvf8-h3et |
| summary |
An issue was discovered in res_pjsip_t38.c in Sangoma Asterisk through 13.x and Certified Asterisk through 13.21-x. If it receives a re-invite initiating T.38 faxing and has a port of 0 and no c line in the SDP, a NULL pointer dereference and crash will occur. This is different from CVE-2019-18940. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2019-18976
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-j6re-kvf8-h3et |
|
| 105 |
| url |
VCID-j7ee-s5dw-eyew |
| vulnerability_id |
VCID-j7ee-s5dw-eyew |
| summary |
Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a series of KEYPAD_BUTTON_MESSAGE events. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-2415
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-j7ee-s5dw-eyew |
|
| 106 |
| url |
VCID-j7sx-6dhs-wbff |
| vulnerability_id |
VCID-j7sx-6dhs-wbff |
| summary |
Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-2186
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-j7sx-6dhs-wbff |
|
| 107 |
| url |
VCID-jfve-1ah7-8ybu |
| vulnerability_id |
VCID-jfve-1ah7-8ybu |
| summary |
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 18.26.4 and 18.9-cert17, RTP UDP ports and internal resources can leak due to a lack of session termination. This could result in leaks and resource exhaustion. This issue has been patched in versions 18.26.4 and 18.9-cert17. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-54995
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jfve-1ah7-8ybu |
|
| 108 |
| url |
VCID-jn6q-ncg1-ufdg |
| vulnerability_id |
VCID-jn6q-ncg1-ufdg |
| summary |
Asterisk Open Source 1.4.5 through 1.4.11, when configured to use an IMAP voicemail storage backend, allows remote attackers to cause a denial of service via an e-mail with an "invalid/corrupted" MIME body, which triggers a crash when the recipient listens to voicemail. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-4521
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jn6q-ncg1-ufdg |
|
| 109 |
| url |
VCID-jytq-x1m9-ryh3 |
| vulnerability_id |
VCID-jytq-x1m9-ryh3 |
| summary |
The IAX2 channel driver (chan_iax2) for Asterisk 1.2.x before 1.2.9 and 1.0.x before 1.0.11 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via truncated IAX 2 (IAX2) video frames, which bypasses a length check and leads to a buffer overflow involving negative length check. NOTE: the vendor advisory claims that only a DoS is possible, but the original researcher is reliable. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2006-2898
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jytq-x1m9-ryh3 |
|
| 110 |
| url |
VCID-k2af-kssx-8fcn |
| vulnerability_id |
VCID-k2af-kssx-8fcn |
| summary |
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-9374
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-k2af-kssx-8fcn |
|
| 111 |
|
| 112 |
| url |
VCID-k8pf-eby2-3ban |
| vulnerability_id |
VCID-k8pf-eby2-3ban |
| summary |
SQL injection vulnerability in the Postgres Realtime Engine (res_config_pgsql) in Asterisk 1.4.x before 1.4.15 and C.x before C.1.0-beta6 allows remote attackers to execute arbitrary SQL commands via unknown vectors. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-6171
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-k8pf-eby2-3ban |
|
| 113 |
| url |
VCID-kmay-1p7g-t7f5 |
| vulnerability_id |
VCID-kmay-1p7g-t7f5 |
| summary |
Stack-based buffer overflow in channels/chan_mgcp.c in MGCP in Asterisk 1.0 through 1.2.10 allows remote attackers to execute arbitrary code via a crafted audit endpoint (AUEP) response. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2006-4345
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kmay-1p7g-t7f5 |
|
| 114 |
|
| 115 |
|
| 116 |
| url |
VCID-m749-tkbh-5ygf |
| vulnerability_id |
VCID-m749-tkbh-5ygf |
| summary |
manager.c in Asterisk Open Source 1.6.1.x before 1.6.1.24, 1.6.2.x before 1.6.2.17.2, and 1.8.x before 1.8.3.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a series of manager sessions involving invalid data. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-1174
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-m749-tkbh-5ygf |
|
| 117 |
|
| 118 |
| url |
VCID-mhw5-v3jy-qqfd |
| vulnerability_id |
VCID-mhw5-v3jy-qqfd |
| summary |
Integer signedness error in format_jpeg.c in Asterisk 1.2.6 and earlier allows remote attackers to execute arbitrary code via a length value that passes a length check as a negative number, but triggers a buffer overflow when it is used as an unsigned length. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2006-1827
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mhw5-v3jy-qqfd |
|
| 119 |
|
| 120 |
| url |
VCID-muku-zk87-hkbv |
| vulnerability_id |
VCID-muku-zk87-hkbv |
| summary |
The SIP channel driver (chan_sip) in Asterisk Open Source 1.4.x before 1.4.11, AsteriskNOW before beta7, Asterisk Appliance Developer Kit 0.x before 0.8.0, and s800i (Asterisk Appliance) 1.x before 1.0.3 allows remote attackers to cause a denial of service (memory exhaustion) via a SIP dialog that causes a large number of history entries to be created. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-4455
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-muku-zk87-hkbv |
|
| 121 |
| url |
VCID-mumx-6vvr-4bbf |
| vulnerability_id |
VCID-mumx-6vvr-4bbf |
| summary |
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-2287
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mumx-6vvr-4bbf |
|
| 122 |
|
| 123 |
| url |
VCID-n7zc-3ycr-akcy |
| vulnerability_id |
VCID-n7zc-3ycr-akcy |
| summary |
A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, which can be triggered by sending specially crafted SCCP packets causing an infinite loop and leading to memory exhaustion (by message logging in that loop). |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2017-9358
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-n7zc-3ycr-akcy |
|
| 124 |
| url |
VCID-nhn9-mw16-pkaf |
| vulnerability_id |
VCID-nhn9-mw16-pkaf |
| summary |
Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a denial of service (resource consumption) by making anonymous calls from multiple sources and consequently adding many entries to the device state cache. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-5977
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nhn9-mw16-pkaf |
|
| 125 |
|
| 126 |
| url |
VCID-nsnm-1fx3-n3dt |
| vulnerability_id |
VCID-nsnm-1fx3-n3dt |
| summary |
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk, trying to disallow shell commands to be run via the Asterisk command line interface (CLI) by configuring `cli_permissions.conf` (e.g. with the config line `deny=!*`) does not work which could lead to a security risk. If an administrator running an Asterisk instance relies on the `cli_permissions.conf` file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability. Versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions 18.9-cert14 and 20.7-cert5 of certified-asterisk fix the issue. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-47780
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nsnm-1fx3-n3dt |
|
| 127 |
| url |
VCID-nwcq-bvn5-qyf7 |
| vulnerability_id |
VCID-nwcq-bvn5-qyf7 |
| summary |
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-4046
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nwcq-bvn5-qyf7 |
|
| 128 |
|
| 129 |
| url |
VCID-p4z2-vafe-2kcq |
| vulnerability_id |
VCID-p4z2-vafe-2kcq |
| summary |
The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which triggers a NULL pointer dereference. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2008-0095
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-p4z2-vafe-2kcq |
|
| 130 |
| url |
VCID-paap-v22a-w7f3 |
| vulnerability_id |
VCID-paap-v22a-w7f3 |
| summary |
Multiple stack-based buffer overflows in the process_sdp function in chan_sip.c of the SIP channel T.38 SDP parser in Asterisk before 1.4.3 allow remote attackers to execute arbitrary code via a long (1) T38FaxRateManagement or (2) T38FaxUdpEC SDP parameter in an SIP message, as demonstrated using SIP INVITE. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-2293
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-paap-v22a-w7f3 |
|
| 131 |
| url |
VCID-ppcr-yrpq-u3g8 |
| vulnerability_id |
VCID-ppcr-yrpq-u3g8 |
| summary |
The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series of requests. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-4597
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ppcr-yrpq-u3g8 |
|
| 132 |
|
| 133 |
|
| 134 |
| url |
VCID-q4a9-x9rc-tued |
| vulnerability_id |
VCID-q4a9-x9rc-tued |
| summary |
Use-after-free vulnerability in the PJSIP channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1, when using the res_pjsip_refer module, allows remote attackers to cause a denial of service (crash) via an in-dialog INVITE with Replaces message, which triggers the channel to be hung up. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-8416
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-q4a9-x9rc-tued |
|
| 135 |
| url |
VCID-qbcd-t5kt-4kbz |
| vulnerability_id |
VCID-qbcd-t5kt-4kbz |
| summary |
An issue was discovered in res_http_websocket.c in Asterisk 15.x through 15.2.1. If the HTTP server is enabled (default is disabled), WebSocket payloads of size 0 are mishandled (with a busy loop). |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2018-7287
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qbcd-t5kt-4kbz |
|
| 136 |
|
| 137 |
|
| 138 |
| url |
VCID-qqzb-4ana-y7cc |
| vulnerability_id |
VCID-qqzb-4ana-y7cc |
| summary |
The SIP channel driver (chan_sip) in Asterisk before 1.2.18 and 1.4.x before 1.4.3 does not properly parse SIP UDP packets that do not contain a valid response code, which allows remote attackers to cause a denial of service (crash). |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-2297
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qqzb-4ana-y7cc |
|
| 139 |
| url |
VCID-qt7n-33ke-nbg9 |
| vulnerability_id |
VCID-qt7n-33ke-nbg9 |
| summary |
Stack-based buffer overflow in the IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to execute arbitrary code by sending a long (1) voice or (2) video RTP frame. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-3762
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-qt7n-33ke-nbg9 |
|
| 140 |
| url |
VCID-r8qs-axpa-dfcq |
| vulnerability_id |
VCID-r8qs-axpa-dfcq |
| summary |
Stack-based buffer overflow in the milliwatt_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6.2.23, 1.8.x before 1.8.10.1, and 10.x before 10.2.1, when the o option is used and the internal_timing option is off, allows remote attackers to cause a denial of service (application crash) via a large number of samples in an audio packet. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-1183
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r8qs-axpa-dfcq |
|
| 141 |
| url |
VCID-r9xj-a3g1-fqa4 |
| vulnerability_id |
VCID-r9xj-a3g1-fqa4 |
| summary |
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, user supplied/control values for Cookies and any GET variable query Parameter are directly interpolated into the HTML of the page using ast_str_append. The endpoint at GET /httpstatus is the potential vulnerable endpoint relating to asterisk/main /http.c. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-23738
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r9xj-a3g1-fqa4 |
|
| 142 |
|
| 143 |
|
| 144 |
|
| 145 |
|
| 146 |
| url |
VCID-rzry-3zwj-z3ce |
| vulnerability_id |
VCID-rzry-3zwj-z3ce |
| summary |
main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-2286
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rzry-3zwj-z3ce |
|
| 147 |
| url |
VCID-s4vy-wpd9-nfeh |
| vulnerability_id |
VCID-s4vy-wpd9-nfeh |
| summary |
The STUN implementation in Asterisk 1.4.x before 1.4.8, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted STUN length attribute in a STUN packet sent on an RTP port. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-3765
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-s4vy-wpd9-nfeh |
|
| 148 |
| url |
VCID-s648-7tjm-dfew |
| vulnerability_id |
VCID-s648-7tjm-dfew |
| summary |
The Skinny channel driver (chan_skinny) in Asterisk Open Source before 1.4.10, AsteriskNOW before beta7, Appliance Developer Kit before 0.7.0, and Appliance s800i before 1.0.3 allows remote authenticated users to cause a denial of service (application crash) via a CAPABILITIES_RES_MESSAGE packet with a capabilities count larger than the capabilities_res_message array population. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-4280
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-s648-7tjm-dfew |
|
| 149 |
|
| 150 |
| url |
VCID-sct3-tg39-cqd2 |
| vulnerability_id |
VCID-sct3-tg39-cqd2 |
| summary |
The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-8412
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sct3-tg39-cqd2 |
|
| 151 |
| url |
VCID-sh84-ms1c-efff |
| vulnerability_id |
VCID-sh84-ms1c-efff |
| summary |
channels/chan_iax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 does not enforce ACL rules during certain uses of peer credentials, which allows remote authenticated users to bypass intended outbound-call restrictions by leveraging the availability of these credentials. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-4737
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sh84-ms1c-efff |
|
| 152 |
| url |
VCID-sktj-tzmw-u7dh |
| vulnerability_id |
VCID-sktj-tzmw-u7dh |
| summary |
Multiple buffer overflows in the voicemail functionality in Asterisk 1.4.x before 1.4.13, when using IMAP storage, might allow (1) remote attackers to execute arbitrary code via a long combination of Content-type and Content-description headers, or (2) local users to execute arbitrary code via a long combination of astspooldir, voicemail context, and voicemail mailbox fields. NOTE: vector 2 requires write access to Asterisk configuration files. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-5358
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sktj-tzmw-u7dh |
|
| 153 |
|
| 154 |
| url |
VCID-srpf-1fvf-e7da |
| vulnerability_id |
VCID-srpf-1fvf-e7da |
| summary |
main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which allows remote attackers to conduct stack-consumption attacks and cause a denial of service (daemon crash) via a crafted HTTP POST request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-5976. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2013-2686
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-srpf-1fvf-e7da |
|
| 155 |
|
| 156 |
| url |
VCID-sxxv-pt4p-pkgd |
| vulnerability_id |
VCID-sxxv-pt4p-pkgd |
| summary |
The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protocol, as demonstrated by the AMI protocol. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-8418
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sxxv-pt4p-pkgd |
|
| 157 |
|
| 158 |
| url |
VCID-t962-kkbp-vyeu |
| vulnerability_id |
VCID-t962-kkbp-vyeu |
| summary |
An issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. A memory leak occurs when an Asterisk pjsip session object is created and that call gets rejected before the session itself is fully established. When this happens the session object never gets destroyed. Eventually Asterisk can run out of memory and crash. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2017-16672
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-t962-kkbp-vyeu |
|
| 159 |
| url |
VCID-te7t-uxgc-93h7 |
| vulnerability_id |
VCID-te7t-uxgc-93h7 |
| summary |
The design of the dialplan functionality in Asterisk Open Source 1.2.x, 1.4.x, and 1.6.x; and Asterisk Business Edition B.x.x and C.x.x, when using the ${EXTEN} channel variable and wildcard pattern matches, allows context-dependent attackers to inject strings into the dialplan using metacharacters that are injected when the variable is expanded, as demonstrated using the Dial application to process a crafted SIP INVITE message that adds an unintended outgoing channel leg. NOTE: it could be argued that this is not a vulnerability in Asterisk, but a class of vulnerabilities that can occur in any program that uses this feature without the associated filtering functionality that is already available. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2010-0685
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-te7t-uxgc-93h7 |
|
| 160 |
|
| 161 |
| url |
VCID-u22x-qs7j-nyan |
| vulnerability_id |
VCID-u22x-qs7j-nyan |
| summary |
The IAX2 channel driver (chan_iax2) in Asterisk before 20070504 does not properly null terminate data, which allows remote attackers to trigger loss of transmitted data, and possibly obtain sensitive information (memory contents) or cause a denial of service (application crash), by sending a frame that lacks a 0 byte. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-2488
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-u22x-qs7j-nyan |
|
| 162 |
|
| 163 |
|
| 164 |
|
| 165 |
| url |
VCID-urjf-anyp-3qhv |
| vulnerability_id |
VCID-urjf-anyp-3qhv |
| summary |
A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR. Thus, it is possible for someone to use an arbitrarily large string and write past the end of the user field storage buffer. NOTE: this is different from CVE-2017-7617, which was only about the Party A buffer. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2017-16671
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-urjf-anyp-3qhv |
|
| 166 |
| url |
VCID-utdf-kxfn-pka3 |
| vulnerability_id |
VCID-utdf-kxfn-pka3 |
| summary |
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-6609
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-utdf-kxfn-pka3 |
|
| 167 |
|
| 168 |
|
| 169 |
|
| 170 |
|
| 171 |
|
| 172 |
|
| 173 |
|
| 174 |
| url |
VCID-whex-hbuj-97ge |
| vulnerability_id |
VCID-whex-hbuj-97ge |
| summary |
Double free vulnerability in apps/app_voicemail.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones allows remote authenticated users to cause a denial of service (daemon crash) by establishing multiple voicemail sessions and accessing both the Urgent mailbox and the INBOX mailbox. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-3812
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-whex-hbuj-97ge |
|
| 175 |
| url |
VCID-wph3-agzg-1yea |
| vulnerability_id |
VCID-wph3-agzg-1yea |
| summary |
Asterisk 1.2.10 supports the use of client-controlled variables to determine filenames in the Record function, which allows remote attackers to (1) execute code via format string specifiers or (2) overwrite files via directory traversals involving unspecified vectors, as demonstrated by the CALLERIDNAME variable. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2006-4346
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wph3-agzg-1yea |
|
| 176 |
| url |
VCID-wqkn-49r3-zyak |
| vulnerability_id |
VCID-wqkn-49r3-zyak |
| summary |
The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition (BE) C.3.x before C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones exhibits different behavior for invalid INVITE, SUBSCRIBE, and REGISTER transactions depending on whether the user account exists, which allows remote attackers to enumerate account names by (1) reading HTTP status codes, (2) reading additional text in a 403 (aka Forbidden) response, or (3) observing whether certain retransmissions occur. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2013-2264
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wqkn-49r3-zyak |
|
| 177 |
| url |
VCID-wxe5-hd3w-ebay |
| vulnerability_id |
VCID-wxe5-hd3w-ebay |
| summary |
Unspecified vulnerability in the SIP channel driver (channels/chan_sip.c) in Asterisk 1.2.x before 1.2.13 and 1.4.x before 1.4.0-beta3 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors that result in the creation of "a real pvt structure" that uses more resources than necessary. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2006-5445
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wxe5-hd3w-ebay |
|
| 178 |
|
| 179 |
|
| 180 |
|
| 181 |
|
| 182 |
|
| 183 |
| url |
VCID-y2d6-pyca-8fh1 |
| vulnerability_id |
VCID-y2d6-pyca-8fh1 |
| summary |
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the asterisk/contrib/scripts/ast_coredumper runs as root, as noted by the NOTES tag on line 689 of the ast_coredumper file. The script will source the contents of /etc/asterisk/ast_debug_tools.conf, which resides in a folder that is writeable by the asterisk user:group. Due to the /etc/asterisk/ast_debug_tools.conf file following bash semantics and it being loaded; an attacker with write permissions may add or modify the file such that when the root ast_coredumper is run; it would source and thereby execute arbitrary bash code found in the /etc/asterisk/ast_debug_tools.conf. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2026-23741
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y2d6-pyca-8fh1 |
|
| 184 |
| url |
VCID-y4c5-z7zt-yuaf |
| vulnerability_id |
VCID-y4c5-z7zt-yuaf |
| summary |
manager.c in the Manager Interface in Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 does not properly check for the system privilege, which allows remote authenticated users to execute arbitrary commands via an Originate action that has an Async header in conjunction with an Application header. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-1599
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y4c5-z7zt-yuaf |
|
| 185 |
| url |
VCID-y5gf-ck7b-w3dw |
| vulnerability_id |
VCID-y5gf-ck7b-w3dw |
| summary |
A NULL pointer access issue was discovered in Asterisk 15.x through 15.2.1. The RTP support in Asterisk maintains its own registry of dynamic codecs and desired payload numbers. While an SDP negotiation may result in a codec using a different payload number, these desired ones are still stored internally. When an RTP packet was received, this registry would be consulted if the payload number was not found in the negotiated SDP. This registry was incorrectly consulted for all packets, even those which are dynamic. If the payload number resulted in a codec of a different type than the RTP stream (for example, the payload number resulted in a video codec but the stream carried audio), a crash could occur if no stream of that type had been negotiated. This was due to the code incorrectly assuming that a stream of that type would always exist. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2018-7285
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y5gf-ck7b-w3dw |
|
| 186 |
| url |
VCID-y93m-uy8a-zbcg |
| vulnerability_id |
VCID-y93m-uy8a-zbcg |
| summary |
Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2015-1558
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-y93m-uy8a-zbcg |
|
| 187 |
|
| 188 |
| url |
VCID-yp4v-q2dc-qbca |
| vulnerability_id |
VCID-yp4v-q2dc-qbca |
| summary |
Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan function. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2011-0495
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-yp4v-q2dc-qbca |
|
| 189 |
|
| 190 |
|
| 191 |
|
| 192 |
|
| 193 |
| url |
VCID-z4g1-1f71-g3dy |
| vulnerability_id |
VCID-z4g1-1f71-g3dy |
| summary |
Multiple stack consumption vulnerabilities in Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones allow remote attackers to cause a denial of service (daemon crash) via TCP data using the (1) SIP, (2) HTTP, or (3) XMPP protocol. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-5976
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-z4g1-1f71-g3dy |
|
| 194 |
| url |
VCID-z7b5-c8qs-tygn |
| vulnerability_id |
VCID-z7b5-c8qs-tygn |
| summary |
Race condition in the chan_pjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a cancel request for a SIP session with a queued action to (1) answer a session or (2) send ringing. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-8415
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-z7b5-c8qs-tygn |
|
| 195 |
|
| 196 |
| url |
VCID-zctx-7u3f-zuhd |
| vulnerability_id |
VCID-zctx-7u3f-zuhd |
| summary |
main/acl.c in Asterisk Open Source 1.6.0.x before 1.6.0.25, 1.6.1.x before 1.6.1.17, and 1.6.2.x before 1.6.2.5 does not properly enforce remote host access controls when CIDR notation "/0" is used in permit= and deny= configuration rules, which causes an improper arithmetic shift and might allow remote attackers to bypass ACL rules and access services from unauthorized hosts. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2010-1224
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zctx-7u3f-zuhd |
|
| 197 |
|
| 198 |
| url |
VCID-zm66-9m5e-2bem |
| vulnerability_id |
VCID-zm66-9m5e-2bem |
| summary |
chan_skinny.c in the Skinny (aka SCCP) channel driver in Asterisk Open Source 10.x before 10.5.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by sending a Station Key Pad Button message and closing a connection in off-hook mode, a related issue to CVE-2012-2948. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2012-3553
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zm66-9m5e-2bem |
|
| 199 |
| url |
VCID-zr5f-baa7-h3h1 |
| vulnerability_id |
VCID-zr5f-baa7-h3h1 |
| summary |
The IAX2 channel driver (chan_iax2) in Asterisk before 1.2.22 and 1.4.x before 1.4.8, Business Edition before B.2.2.1, AsteriskNOW before beta7, Appliance Developer Kit before 0.5.0, and s800i before 1.0.2 allows remote attackers to cause a denial of service (crash) via a crafted (1) LAGRQ or (2) LAGRP frame that contains information elements of IAX frames, which results in a NULL pointer dereference when Asterisk does not properly set an associated variable. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-3763
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zr5f-baa7-h3h1 |
|
| 200 |
| url |
VCID-zrcm-vdc5-bffj |
| vulnerability_id |
VCID-zrcm-vdc5-bffj |
| summary |
The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2014-8413
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zrcm-vdc5-bffj |
|
| 201 |
| url |
VCID-zta3-e3f4-2qau |
| vulnerability_id |
VCID-zta3-e3f4-2qau |
| summary |
The IAX2 channel driver (chan_iax2) in Asterisk Open 1.2.x before 1.2.23, 1.4.x before 1.4.9, and Asterisk Appliance Developer Kit before 0.6.0, when configured to allow unauthenticated calls, allows remote attackers to cause a denial of service (resource exhaustion) via a flood of calls that do not complete a 3-way handshake, which causes an ast_channel to be allocated but not released. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2007-4103
|
| risk_score |
null |
| exploitability |
null |
| weighted_severity |
null |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zta3-e3f4-2qau |
|
| 202 |
|