Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.8
CVSSv2

CVE-2011-1147

Published: 15/03/2011 Updated: 24/08/2011
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Subscribe to Asterisk

Vulnerability Summary

Multiple stack-based and heap-based buffer overflows in the (1) decode_open_type and (2) udptl_rx_packet functions in main/udptl.c in Asterisk Open Source 1.4.x prior to 1.4.39.2, 1.6.1.x prior to 1.6.1.22, 1.6.2.x prior to 1.6.2.16.2, and 1.8 prior to 1.8.2.4; Business Edition C.x.x before C.3.6.3; AsteriskNOW 1.5; and s800i (Asterisk Appliance), when T.38 support is enabled, allow remote malicious users to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDPTL packet.

Vulnerable Product Search on Vulmon Subscribe to Product

digium asterisk 1.4.29

digium asterisk 1.4.19

digium asterisk 1.4.19.2

digium asterisk 1.4.30

digium asterisk 1.4.20

digium asterisk 1.4.20.1

digium asterisk 1.4.0

digium asterisk 1.4.10.1

digium asterisk 1.4.17

digium asterisk 1.4.16.2

digium asterisk 1.4.25.1

digium asterisk 1.4.25

digium asterisk 1.4.26.3

digium asterisk 1.4.22

digium asterisk 1.4.23.2

digium asterisk 1.4.23

digium asterisk 1.4.28

digium asterisk 1.4.29.1

digium asterisk 1.4.21

digium asterisk 1.4.21.1

digium asterisk 1.4.15

digium asterisk 1.4.13

digium asterisk 1.4.26

digium asterisk 1.4.27

digium asterisk 1.4.22.2

digium asterisk 1.4.24

digium asterisk 1.4.35

digium asterisk 1.4.33

digium asterisk 1.4.3

digium asterisk 1.4.39

digium asterisk 1.4.39.1

digium asterisk 1.4.2

digium asterisk 1.4.31

digium asterisk 1.4.10

digium asterisk 1.4.12.1

digium asterisk 1.4.11

digium asterisk 1.4.18

digium asterisk 1.4.26.1

digium asterisk 1.4.23.1

digium asterisk 1.4.33.1

digium asterisk 1.4.12

digium asterisk 1.4.36

digium asterisk 1.4.27.1

digium asterisk 1.4.34

digium asterisk 1.4.37

digium asterisk 1.4.19.1

digium asterisk 1.4.21.2

digium asterisk 1.4.1

digium asterisk 1.4.16.1

digium asterisk 1.4.16

digium asterisk 1.4.14

digium asterisk 1.4.26.2

digium asterisk 1.4.22.1

digium asterisk 1.4.24.1

digium asterisk 1.4.32

digium asterisk 1.4.38

digium asterisk 1.6.2.0

digium asterisk 1.6.2.3

digium asterisk 1.6.2.4

digium asterisk 1.6.2.6

digium asterisk 1.6.2.1

digium asterisk 1.6.2.2

digium asterisk 1.6.2.16.1

digium asterisk 1.6.2.15

digium asterisk 1.6.2.5

digium asterisk 1.6.2.16

digium asterisk 1.8.1.2

digium asterisk 1.8.1.1

digium asterisk 1.8.0

digium asterisk 1.8.1

digium asterisk 1.8.2.2

digium asterisk 1.8.2.3

digium asterisk 1.8.2

digium asterisk 1.8.2.1

digium asterisk c.1.0

digium asterisk c.3.3.2

digium asterisk c.3.2.2

digium asterisk c.3.1.0

digium asterisk c.1.6.1

digium asterisk c.3.6.2

digium asterisk c.3.2.3

digium asterisk c.1.8.1

digium asterisk c.1.6.2

digium asterisk c.3.1.1

digium asterisk c.3.0

digium asterisk c.1.6

digium asterisk c.1.8.0

digium asterisk c.2.3

digium asterisknow 1.5

digium s800i

digium asterisk 1.6.1.1

digium asterisk 1.6.1.10

digium asterisk 1.6.1.7

digium asterisk 1.6.1.20

digium asterisk 1.6.1.19

digium asterisk 1.6.1.12

digium asterisk 1.6.1.0

digium asterisk 1.6.1.16

digium asterisk 1.6.1.5

digium asterisk 1.6.1.6

digium asterisk 1.6.1.18

digium asterisk 1.6.1.13

digium asterisk 1.6.1.21

digium asterisk 1.6.1.2

digium asterisk 1.6.1.3

digium asterisk 1.6.1.8

digium asterisk 1.6.1.9

digium asterisk 1.6.1.4

digium asterisk 1.6.1.17

digium asterisk 1.6.1.11

digium asterisk 1.6.1.14

digium asterisk 1.6.1.15

Vendor Advisories

Debian CVElist Bug Report Logs: asterisk: AST-2011-002: Multiple array overflow and crash vulnerabilities in UDPTL code
Debian Bug report logs - #614580 asterisk: AST-2011-002: Multiple array overflow and crash vulnerabilities in UDPTL code Package: asterisk; Maintainer for asterisk is Debian VoIP Team <pkg-voip-maintainers@listsaliothdebianorg>; Source for asterisk is src:asterisk (PTS, buildd, popcon) Reported by: Tzafrir Cohen <tzaf ...
Debian Security Advisories: DSA-2225-1 asterisk -- several vulnerabilities
Several vulnerabilities have been discovered in Asterisk, an Open Source PBX and telephony toolkit CVE-2011-1147 Matthew Nicholson discovered that incorrect handling of UDPTL packets may lead to denial of service or the execution of arbitrary code CVE-2011-1174 Blake Cornell discovered that incorrect connection handling in the manage ...

References

CWE-119http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055634.htmlhttp://www.openwall.com/lists/oss-security/2011/03/11/8http://secunia.com/advisories/43702http://secunia.com/advisories/43429http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055030.htmlhttp://www.vupen.com/english/advisories/2011/0635http://downloads.asterisk.org/pub/security/AST-2011-002.htmlhttp://www.securityfocus.com/bid/46474http://www.openwall.com/lists/oss-security/2011/03/11/2http://www.securitytracker.com/id?1025101http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055421.htmlhttp://www.debian.org/security/2011/dsa-2225https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=614580https://nvd.nist.govhttps://www.debian.org/security/./dsa-2225
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322administrator privilegesCVE-2024-1579hardcodedCVE-2023-20198CVE-2024-33587CVE-2024-33449CVE-2024-4308HTML injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook