PT-2009-3463 · Digium · Asterisk Open Source+1

Published 2009-03-11 · Updated 2018-10-10 · CVE-2009-0871

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.4.22 through 1.4.23.1 Asterisk Open Source versions 1.6.0 through 1.6.0.5 Asterisk Open Source version 1.6.1 before 1.6.1.0-rc2 Asterisk Business Edition version C.2.3

Description The issue allows remote authenticated users to cause a denial of service via a SIP INVITE request without any headers. This triggers a NULL pointer dereference in the (1) sip uri headers cmp and (2) sip uri params cmp functions when the pedantic option is enabled.

Recommendations For Asterisk Open Source versions 1.4.22 through 1.4.23.1, update to a version outside of this range to resolve the issue. For Asterisk Open Source versions 1.6.0 through 1.6.0.5, update to version 1.6.0.6 or later. For Asterisk Open Source version 1.6.1 before 1.6.1.0-rc2, update to version 1.6.1.0-rc2 or later. For Asterisk Business Edition version C.2.3, consider disabling the pedantic option as a temporary workaround until a patch is available.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-0871

Affected Products

Asterisk Business Edition

Asterisk Open Source

References · 11

• http://secunia.com/advisories/34229 · Vendor Advisory
• http://downloads.digium.com/pub/security/AST-2009-002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0871 · Security Note
• http://securityfocus.com/bid/34070 · Patch
• http://vupen.com/english/advisories/2009/0667 · Note
• http://osvdb.org/52568 · Note
• http://securitytracker.com/id?1021834 · Note
• http://securityfocus.com/archive/1/501656/100/0/threaded · Note
• http://bugs.digium.com/view.php?id=14417 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0871 · Note
• http://bugs.digium.com/view.php?id=13547 · Note