Published: 18/09/2012 Updated: 29/08/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 755

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x prior to 1.8.10.1 and 10.x prior to 10.2.1 allows remote malicious users to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header.

Vulnerable Product	Search on Vulmon	Subscribe to Product
digium asterisk 1.8.0
digium asterisk 1.8.2.2
digium asterisk 1.8.2.1
digium asterisk 1.8.3
digium asterisk 1.8.3.2
digium asterisk 1.8.4.1
digium asterisk 1.8.4.3
digium asterisk 1.8.6.0
digium asterisk 1.8.8.0
digium asterisk 1.8.9.3
digium asterisk 1.8.9.0
digium asterisk 1.8.10.0
digium asterisk 1.8.3.3
digium asterisk 1.8.4
digium asterisk 1.8.5
digium asterisk 1.8.5.0
digium asterisk 1.8.7.0
digium asterisk 1.8.7.1
digium asterisk 1.8.8.2
digium asterisk 1.8.9.1
digium asterisk 1.8.2.3
digium asterisk 1.8.3.1
digium asterisk 1.8.9.2
digium asterisk 1.8.2
digium asterisk 1.8.2.4
digium asterisk 1.8.1.2
digium asterisk 1.8.1.1
digium asterisk 1.8.4.2
digium asterisk 1.8.4.4
digium asterisk 1.8.8.1
digium asterisk 10.0.0
digium asterisk 10.1.3
digium asterisk 10.2.0
digium asterisk 10.1.0
digium asterisk 10.0.1
digium asterisk 10.1.2
digium asterisk 10.1.1

Debian Bug report logs - #664411 [CVE-2012-1183 - CVE-2012-1184] Asterisk: AST-2012-002 and AST-2012-003 flaws Package: asterisk; Maintainer for asterisk is Debian VoIP Team <pkg-voip-maintainers@listsaliothdebianorg>; Source for asterisk is src:asterisk (PTS, buildd, popcon) Reported by: Luciano Bello <luciano@debian ...

=========================== Description =========================== There is a remotely exploitable stack buffer overflow in HTTP digest authentication handling in Asterisk This vulnerability includes the possibility of code execution with plenty of stack space for inserting custom code to run I wrote an example exploit to verify that the vulne ...

CWE-119 http://www.securitytracker.com/id?1026813 http://downloads.asterisk.org/pub/security/AST-2012-003-1.8.diff http://www.asterisk.org/node/51797 http://secunia.com/advisories/48417 http://www.openwall.com/lists/oss-security/2012/03/16/10 http://downloads.asterisk.org/pub/security/AST-2012-003.pdf http://www.openwall.com/lists/oss-security/2012/03/16/17 http://osvdb.org/80126 https://exchange.xforce.ibmcloud.com/vulnerabilities/74083 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=664411 https://nvd.nist.gov https://www.exploit-db.com/exploits/18855/

CVE-2012-1184

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect