3.5

CVE-2009-0871

The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service (crash) via a SIP INVITE request without any headers, which triggers a NULL pointer dereference in the (1) sip_uri_headers_cmp and (2) sip_uri_params_cmp functions.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Digium ≫ Asterisk Version 1.4.22
Digium ≫ Asterisk Version 1.4.23
Digium ≫ Asterisk Version 1.4.23.1
Digium ≫ Asterisk Version 1.6.0
Digium ≫ Asterisk Version 1.6.0 Update beta1
Digium ≫ Asterisk Version 1.6.0 Update beta2
Digium ≫ Asterisk Version 1.6.0 Update beta3
Digium ≫ Asterisk Version 1.6.0 Update beta4
Digium ≫ Asterisk Version 1.6.0 Update beta5
Digium ≫ Asterisk Version 1.6.0 Update beta6
Digium ≫ Asterisk Version 1.6.0 Update beta7
Digium ≫ Asterisk Version 1.6.0 Update beta7.1
Digium ≫ Asterisk Version 1.6.0 Update beta8
Digium ≫ Asterisk Version 1.6.0 Update beta9
Digium ≫ Asterisk Version 1.6.0 Update rc4
Digium ≫ Asterisk Version 1.6.0 Update rc5
Digium ≫ Asterisk Version 1.6.0 Update rc6
Digium ≫ Asterisk Version 1.6.0.1
Digium ≫ Asterisk Version 1.6.0.2
Digium ≫ Asterisk Version 1.6.0.3
Digium ≫ Asterisk Version 1.6.0.3 Update rc1
Digium ≫ Asterisk Version 1.6.0.4 Update rc1
Digium ≫ Asterisk Version 1.6.0.5
Digium ≫ Asterisk Version 1.6.1
Digium ≫ Asterisk Version 1.6.1 Update beta1
Digium ≫ Asterisk Version 1.6.1 Update beta2
Digium ≫ Asterisk Version 1.6.1 Update beta3
Digium ≫ Asterisk Version 1.6.1 Update beta4
Digium ≫ Asterisk Version 1.6.1 Update rc1
Digium ≫ Asterisk Version c.2.3 Update - Edition business
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.57% 0.831
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:N/I:N/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://bugs.digium.com/view.php?id=13547
http://bugs.digium.com/view.php?id=14417
http://downloads.digium.com/pub/security/AST-2009-002.html
Patch
Vendor Advisory
http://osvdb.org/52568
http://secunia.com/advisories/34229
Vendor Advisory
http://www.securityfocus.com/archive/1/501656/100/0/threaded
http://www.securityfocus.com/bid/34070
Patch
http://www.securitytracker.com/id?1021834
http://www.vupen.com/english/advisories/2009/0667