4.3
CVSSv2

CVE-2011-4598

Published: 15/12/2011 Updated: 01/09/2012
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
VMScore: 383
Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P

Vulnerability Summary

The handle_request_info function in channels/chan_sip.c in Asterisk Open Source 1.6.2.x prior to 1.6.2.21 and 1.8.x prior to 1.8.7.2, when automon is enabled, allows remote malicious users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted sequence of SIP requests.

Vulnerable Product Search on Vulmon Subscribe to Product

digium asterisk 1.8.4

digium asterisk 1.8.3.3

digium asterisk 1.8.0

digium asterisk 1.8.2.2

digium asterisk 1.8.2.1

digium asterisk 1.8.3

digium asterisk 1.8.3.2

digium asterisk 1.8.4.1

digium asterisk 1.8.2

digium asterisk 1.8.2.4

digium asterisk 1.8.4.2

digium asterisk 1.8.4.3

digium asterisk 1.8.6.0

digium asterisk 1.8.1.1

digium asterisk 1.8.2.3

digium asterisk 1.8.3.1

digium asterisk 1.8.5

digium asterisk 1.8.5.0

digium asterisk 1.8.7.0

digium asterisk 1.8.7.1

digium asterisk 1.8.1.2

digium asterisk 1.8.1

digium asterisk 1.8.4.4

digium asterisk 1.6.2.17.2

digium asterisk 1.6.2.16.2

digium asterisk 1.6.2.0

digium asterisk 1.6.2.1

digium asterisk 1.6.2.17

digium asterisk 1.6.2.16

digium asterisk 1.6.2.16.1

digium asterisk 1.6.2.15

digium asterisk 1.6.2.17.1

digium asterisk 1.6.2.20

digium asterisk 1.6.2.21

digium asterisk 1.6.2.6

digium asterisk 1.6.2.5

digium asterisk 1.6.2.4

digium asterisk 1.6.2.18

digium asterisk 1.6.2.19

digium asterisk 1.6.2.2

digium asterisk 1.6.2.3

digium asterisk 1.6.2.17.3

Vendor Advisories

Debian Bug report logs - #651552 CVE-2011-4598: DoS Package: src:asterisk; Maintainer for src:asterisk is Debian VoIP Team <pkg-voip-maintainers@listsaliothdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Fri, 9 Dec 2011 20:48:02 UTC Severity: grave Tags: security Fixed in versions asterisk/1:1 ...
Several vulnerabilities have been discovered in Asterisk, an Open Source PBX and telephony toolkit: CVE-2011-4597 Ben Williams discovered that it was possible to enumerate SIP user names in some configurations Please see the upstream advisory for details This update only modifies the sample sipconf configuration file Please see ...