CVE-2012-2947 — Improper Access Control in Asterisk

CWE-284 — Improper Access Control7 documents5 sources
Severity
2.6LOWNVD
EPSS
4.3%
top 11.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Digium AsteriskDebian AsteriskDebian Linux+1 more
Timeline
PublishedJun 2
Latest updateMay 17

Description

chan_iax2.c in the IAX2 channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1, when a certain mohinterpret setting is enabled, allows remote attackers to cause a denial of service (daemon crash) by placing a call on hold.

CVSS vector

AV:N/AC:H/C:N/I:N/A:PExploitability: 4.9 | Impact: 2.9

Affected Packages4 packages

▶debiandebian/asterisk< asterisk 1:1.8.13.0~dfsg-1 (bullseye)
▶Debiandigium/asterisk< 1:1.8.13.0~dfsg-1
▶NVDdigium/asterisk47 versions+46

Also affects: Debian Linux 6.0

🔴Vulnerability Details

2
GHSA
GHSA-h4qr-ghfm-gmxm: chan_iax2↗2022-05-17
▶
OSV
CVE-2012-2947: chan_iax2↗2012-06-02
▶

📋Vendor Advisories

1
Debian
CVE-2012-2947: asterisk - chan_iax2.c in the IAX2 channel driver in Certified Asterisk 1.8.11-cert before ...↗2012
▶

💬Community

3
Bugzilla
CVE-2012-2947 asterisk: Remote crash in IAX2 channel driver (AST-2012-007)↗2012-05-30
▶
Bugzilla
CVE-2012-2947 CVE-2012-2948 asterisk various flaws [fedora-all]↗2012-05-30
▶
Bugzilla
CVE-2012-2947 CVE-2012-2948 asterisk various flaws [epel-6]↗2012-05-30
▶
CVE-2012-2947 — Improper Access Control in Asterisk | cvebase