PT-2014-7300 · Digium · Certified Asterisk+2

Philippe Lindheimer · Publicado 2014-11-26 · Atualizado 2014-11-26 · CVE-2014-6610

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 11.x through 11.12.0 Asterisk Open Source versions 12.x through 12.4.0 Certified Asterisk versions 11.6 through 11.6-cert5

Description The issue allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application when using the res fax spandsp module.

Recommendations For Asterisk Open Source versions 11.x through 11.12.0, update to version 11.12.1 or later. For Asterisk Open Source versions 12.x through 12.4.0, update to version 12.5.1 or later. For Certified Asterisk versions 11.6 through 11.6-cert5, update to version 11.6-cert6 or later.

Correção

DoS

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

CVE-2014-6610

DLA-455-1

MGASA-2014-0490

Produtos afetados

Asterisk Open Source

Certified Asterisk

Res Fax Spandsp

Referências · 17

• http://downloads.asterisk.org/pub/security/AST-2014-014.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-6610 · Aviso do Fabricante
• http://downloads.asterisk.org/pub/security/AST-2014-017.html · Nota
• http://downloads.asterisk.org/pub/security/AST-2014-018.html · Nota
• http://downloads.asterisk.org/pub/security/AST-2014-012.html · Nota
• http://downloads.asterisk.org/pub/telephony/asterisk/releases/ChangeLog-11.14.1 · Nota
• http://downloads.asterisk.org/pub/security/AST-2014-010.html · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2014-0490 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-6610 · Nota de Segurança
• http://mandriva.com/en/support/security/advisories/mbs1/MDVSA-2014%3A218 · Nota
• https://osv.dev/vulnerability/CVE-2014-6610 · Aviso do Fabricante
• http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-11.14.1-summary.html · Nota
• https://advisories.mageia.org/MGASA-2014-0490.html · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-6610 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6610 · Nota