CVE-2014-2289 — Improper Input Validation in Asterisk

CWE-20 — Improper Input Validation3 documents3 sources
Severity
3.5LOWNVD
EPSS
3.7%
top 12.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Digium AsteriskDebian Asterisk
Timeline
PublishedApr 18
Latest updateMay 17

Description

res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.

CVSS vector

AV:N/AC:M/C:N/I:N/A:PExploitability: 6.8 | Impact: 2.9

Affected Packages2 packages

▶NVDdigium/asterisk12.0.0, 12.1.0+1

Patches

Patch: downloads.asterisk.org ↗Patch: downloads.asterisk.org ↗Patch: downloads.asterisk.org ↗

🔴Vulnerability Details

1
GHSA
GHSA-h685-6qvr-7qxj: res/res_pjsip_exten_state↗2022-05-17
▶

📋Vendor Advisories

1
Debian
CVE-2014-2289: asterisk - res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source ...↗2014
▶