Published: 02/06/2012 Updated: 29/08/2017

CVSS v2 Base Score: 4 | Impact Score: 2.9 | Exploitability Score: 8

VMScore: 356

Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P

chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert prior to 1.8.11-cert2 and Asterisk Open Source 1.8.x prior to 1.8.12.1 and 10.x prior to 10.4.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by closing a connection in off-hook mode.

Vulnerable Product	Search on Vulmon	Subscribe to Product
asterisk certified asterisk 1.8.11
asterisk open source
asterisk open source 1.8.12.0
asterisk open source 1.8.10.0
asterisk open source 1.8.9.0
asterisk open source 1.8.8.0
asterisk open source 1.8.7.0
asterisk open source 1.8.6.0
asterisk open source 1.8.2
asterisk open source 1.8.0
asterisk open source 1.8.11.0
asterisk open source 1.8.5
asterisk open source 1.8.3
asterisk open source 1.8.1
asterisk open source 1.8.12
asterisk open source 1.8.5.0
asterisk open source 10.4.0
asterisk open source 10.2.0
asterisk open source 10.0.0
asterisk open source 10.3.0
asterisk open source 10.1.0
asterisk open source 10.3

Debian Bug report logs - #675210 asterisk: AST-2012-008 (CVE-2012-2948): remote crash issue in chan_skinny Package: asterisk; Maintainer for asterisk is Debian VoIP Team <pkg-voip-maintainers@listsaliothdebianorg>; Source for asterisk is src:asterisk (PTS, buildd, popcon) Reported by: Tzafrir Cohen <tzafrir@debianorg& ...

Debian Bug report logs - #675204 asterisk: AST-2012-007 (CVE-2012-2947): crash on IAX receiving HOLD without MOH class Package: asterisk; Maintainer for asterisk is Debian VoIP Team <pkg-voip-maintainers@listsaliothdebianorg>; Source for asterisk is src:asterisk (PTS, buildd, popcon) Reported by: Tzafrir Cohen <tzafrir ...

Several vulnerabilities were discovered in Asterisk, a PBX and telephony toolkit CVE-2012-2947 The IAX2 channel driver allows remote attackers to cause a denial of service (daemon crash) by placing a call on hold (when a certain mohinterpret setting is enabled) CVE-2012-2948 The Skinny channel driver allows remote authenticated users to cau ...

CWE-399 http://downloads.asterisk.org/pub/security/AST-2012-008.html http://www.debian.org/security/2012/dsa-2493 http://www.securitytracker.com/id?1027103 http://www.securityfocus.com/bid/53723 http://secunia.com/advisories/49303 http://archives.neohapsis.com/archives/bugtraq/2012-05/0145.html https://exchange.xforce.ibmcloud.com/vulnerabilities/75937 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=675210 https://www.debian.org/security/./dsa-2493

CVE-2012-2948

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect