CVE-2011-1175 — Asterisk vulnerability

5 documents5 sources
Severity
5.0MEDIUMNVD
EPSS
0.3%
top 48.12%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Digium AsteriskDebian Asterisk
Timeline
PublishedMar 31
Latest updateMay 17

Description

tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/asterisk< asterisk 1:1.8.3.3-1 (bullseye)
▶Debiandigium/asterisk< 1:1.8.3.3-1
▶NVDdigium/asterisk44 versions+43

Patches

Patch: downloads.asterisk.org ↗Patch: lists.fedoraproject.org ↗Patch: openwall.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-cfj4-pwcj-qhgc: tcptls↗2022-05-17
▶
OSV
CVE-2011-1175: tcptls↗2011-03-31
▶

📋Vendor Advisories

1
Debian
CVE-2011-1175: asterisk - tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, ...↗2011
▶

💬Community

1
Bugzilla
CVE-2011-1175 asterisk: DoS in TCP/TLS server due to NULL ptr deref (AST-2011-004)↗2011-03-17
▶