CVE-2011-2535 — Improper Input Validation in Asterisk

CWE-20 — Improper Input Validation4 documents4 sources
Severity
5.0MEDIUMNVD
EPSS
0.2%
top 60.42%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Digium AsteriskDebian Asterisk
Timeline
PublishedJul 6
Latest updateMay 17

Description

chan_iax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted frame.

CVSS vector

AV:N/AC:L/C:N/I:N/A:PExploitability: 10.0 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/asterisk< asterisk 1:1.8.4.3-1 (bullseye)
▶Debiandigium/asterisk< 1:1.8.4.3-1
▶NVDdigium/asterisk109 versions+108

Patches

Patch: downloads.asterisk.org ↗Patch: downloads.asterisk.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-f83p-664c-8vw5: chan_iax2↗2022-05-17
▶
OSV
CVE-2011-2535: chan_iax2↗2011-07-06
▶

📋Vendor Advisories

1
Debian
CVE-2011-2535: asterisk - chan_iax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4....↗2011
▶