7.5
CVE-2014-2286
- EPSS 16.39%
- Veröffentlicht 18.04.2014 22:14:37
- Zuletzt bearbeitet 06.05.2026 22:30:45
- Erkennungen
Loginmain/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fedoraproject ≫ Fedora Version 19
Fedoraproject ≫ Fedora Version 20
Digium ≫ Certified Asterisk Version 1.8.0.0 Update -
Digium ≫ Certified Asterisk Version 1.8.0.0 Update beta1
Digium ≫ Certified Asterisk Version 1.8.0.0 Update beta2
Digium ≫ Certified Asterisk Version 1.8.0.0 Update beta3
Digium ≫ Certified Asterisk Version 1.8.0.0 Update beta4
Digium ≫ Certified Asterisk Version 1.8.0.0 Update beta5
Digium ≫ Certified Asterisk Version 1.8.0.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.0.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.0.0 Update rc3
Digium ≫ Certified Asterisk Version 1.8.0.0 Update rc4
Digium ≫ Certified Asterisk Version 1.8.0.0 Update rc5
Digium ≫ Certified Asterisk Version 1.8.1.0 Update -
Digium ≫ Certified Asterisk Version 1.8.1.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.2.0 Update -
Digium ≫ Certified Asterisk Version 1.8.2.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.3.0 Update -
Digium ≫ Certified Asterisk Version 1.8.3.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.3.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.3.0 Update rc3
Digium ≫ Certified Asterisk Version 1.8.4.0 Update -
Digium ≫ Certified Asterisk Version 1.8.4.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.4.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.4.0 Update rc3
Digium ≫ Certified Asterisk Version 1.8.5.0 Update -
Digium ≫ Certified Asterisk Version 1.8.5.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.6.0 Update -
Digium ≫ Certified Asterisk Version 1.8.6.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.6.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.6.0 Update rc3
Digium ≫ Certified Asterisk Version 1.8.7.0 Update -
Digium ≫ Certified Asterisk Version 1.8.7.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.7.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.8.0 Update -
Digium ≫ Certified Asterisk Version 1.8.8.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.8.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.8.0 Update rc3
Digium ≫ Certified Asterisk Version 1.8.8.0 Update rc4
Digium ≫ Certified Asterisk Version 1.8.8.0 Update rc5
Digium ≫ Certified Asterisk Version 1.8.9.0 Update -
Digium ≫ Certified Asterisk Version 1.8.9.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.9.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.9.0 Update rc3
Digium ≫ Certified Asterisk Version 1.8.10.0 Update -
Digium ≫ Certified Asterisk Version 1.8.10.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.10.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.10.0 Update rc3
Digium ≫ Certified Asterisk Version 1.8.10.0 Update rc4
Digium ≫ Certified Asterisk Version 1.8.11.0 Update -
Digium ≫ Certified Asterisk Version 1.8.11.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.11.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.11.0 Update rc3
Digium ≫ Certified Asterisk Version 1.8.12.0 Update -
Digium ≫ Certified Asterisk Version 1.8.12.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.12.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.12.0 Update rc3
Digium ≫ Certified Asterisk Version 1.8.13.0 Update -
Digium ≫ Certified Asterisk Version 1.8.13.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.13.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.14.0 Update rc1
Digium ≫ Certified Asterisk Version 1.8.14.0 Update rc2
Digium ≫ Certified Asterisk Version 1.8.15 Update -
Digium ≫ Certified Asterisk Version 1.8.15 Update cert1
Digium ≫ Certified Asterisk Version 1.8.15 Update cert1_rc1
Digium ≫ Certified Asterisk Version 1.8.15 Update cert1_rc2
Digium ≫ Certified Asterisk Version 1.8.15 Update cert1_rc3
Digium ≫ Certified Asterisk Version 1.8.15 Update cert2
Digium ≫ Certified Asterisk Version 1.8.15 Update cert3
Digium ≫ Certified Asterisk Version 1.8.15 Update cert4
Digium ≫ Certified Asterisk Version 11.6 Update cert1
Digium ≫ Certified Asterisk Version 11.6 Update cert1_rc1
Digium ≫ Certified Asterisk Version 11.6 Update cert1_rc2
Digium ≫ Certified Asterisk Version 11.6.0 Update -
Digium ≫ Certified Asterisk Version 11.6.0 Update rc1
Digium ≫ Certified Asterisk Version 11.6.0 Update rc2
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 16.39% | 0.966 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 7.5 | 10 | 6.4 |
AV:N/AC:L/Au:N/C:P/I:P/A:P
|
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff
http://downloads.asterisk.org/pub/security/AST-2014-001.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html
http://www.mandriva.com/security/advisories?name=MDVSA-2014:078
http://www.securityfocus.com/bid/66093
https://issues.asterisk.org/jira/browse/ASTERISK-23340