PT-2009-3463 · Digium · Asterisk Open Source+1

Publicado 2009-03-11 · Atualizado 2018-10-10 · CVE-2009-0871

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.22 through 1.4.23.1 Asterisk Open Source versions 1.6.0 through 1.6.0.5 Asterisk Open Source version 1.6.1 before 1.6.1.0-rc2 Asterisk Business Edition version C.2.3

Description The issue allows remote authenticated users to cause a denial of service via a SIP INVITE request without any headers. This triggers a NULL pointer dereference in the (1) sip uri headers cmp and (2) sip uri params cmp functions when the pedantic option is enabled.

Recommendations For Asterisk Open Source versions 1.4.22 through 1.4.23.1, update to a version outside of this range to resolve the issue. For Asterisk Open Source versions 1.6.0 through 1.6.0.5, update to version 1.6.0.6 or later. For Asterisk Open Source version 1.6.1 before 1.6.1.0-rc2, update to version 1.6.1.0-rc2 or later. For Asterisk Business Edition version C.2.3, consider disabling the pedantic option as a temporary workaround until a patch is available.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-0871

Produtos afetados

Asterisk Business Edition

Asterisk Open Source

Referências · 11

• http://vupen.com/english/advisories/2009/0667 · Nota
• http://secunia.com/advisories/34229 · Aviso do Fabricante
• http://osvdb.org/52568 · Nota
• http://downloads.digium.com/pub/security/AST-2009-002.html · Aviso do Fabricante
• http://securitytracker.com/id?1021834 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0871 · Nota de Segurança
• http://securityfocus.com/archive/1/501656/100/0/threaded · Nota
• http://securityfocus.com/bid/34070 · Correção
• http://bugs.digium.com/view.php?id=14417 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0871 · Nota
• http://bugs.digium.com/view.php?id=13547 · Nota