PT-2014-8511 · Digium · Asterisk

Yaron Nahum · Published 2014-11-24 · Updated 2019-07-16 · CVE-2014-8415

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 12.x through 12.7.0 Asterisk Open Source versions 13.x through 13.0.0

Description A race condition exists in the chan pjsip channel driver, allowing remote attackers to cause a denial of service via a cancel request for a SIP session with a queued action to answer a session or send ringing.

Recommendations For Asterisk Open Source versions 12.x through 12.7.0, update to version 12.7.1 or later. For Asterisk Open Source versions 13.x through 13.0.0, update to version 13.0.1 or later.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-8415

Affected Products

Asterisk

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-8415 · Security Note
• https://osv.dev/vulnerability/CVE-2014-8415 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-8415 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-8415 · Vendor Advisory
• http://downloads.asterisk.org/pub/security/AST-2014-015.html · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8415 · Note