CVSS: 4.3EPSS: 57%CPEs: 322EXPL: 0CVE-2015-3008
https://notcve.org/view.php?id=CVE-2015-3008
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Asterisk Open Source 1.8 anterior a 1.8.32.3, 11.x anterior a 11.17.1, 12.x anterior a 12.8.2, y 13.x anterior a 13.3.2 y Certified Asterisk 1.8.28 anterior a 1.8.28-cert5, 11.6 anterior a 11.6-cert11, y 13.1 anterior a 13.1-cert2, cuando registra un dispositivo SIP TLS, no maneja correctamente un byte nulo en un nombre de dominio en el campo Common Name (CN) del sujeto de un certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL arbitrarios a través de un certificado manipulado emitido por una autoridad de certificación legítima. • http://advisories.mageia.org/MGASA-2015-0153.html http://downloads.asterisk.org/pub/security/AST-2015-003.html http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162260.html http://packetstormsecurity.com/files/131364/Asterisk-Project-Security-Advisory-AST-2015-003.html http://seclists.org/fulldisclosure/2015/Apr/22 http://www.debian.org/security/2016/dsa-3700 http://www.mandriva.com/security/advisories?name=MDVSA-2015:206 http://www.securityfocus.com/archive/1/535222/100/0 • CWE-310: Cryptographic Issues •
CVSS: 3.5EPSS: 0%CPEs: 34EXPL: 0CVE-2015-1558
https://notcve.org/view.php?id=CVE-2015-1558
Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs. Asterisk Open Source 12.x anterior a 12.8.1 y 13.x anterior a 13.1.1, cuando utiliza el controlador de canales PJSIP, no recupera correctamente los puertos RTP, lo que permite a usuarios remotos autenticados causar una denegación de servicio (consumo del descriptor de ficheros) a través de una oferta SDP que contiene solamente codecs incompatibles. • http://downloads.asterisk.org/pub/security/AST-2015-001.html http://seclists.org/fulldisclosure/2015/Jan/116 http://www.securityfocus.com/archive/1/534573/100/0/threaded http://www.securitytracker.com/id/1031661 • CWE-399: Resource Management Errors •
CVSS: 5.0EPSS: 3%CPEs: 80EXPL: 0CVE-2014-9374
https://notcve.org/view.php?id=CVE-2014-9374
Double free vulnerability in the WebSocket Server (res_http_websocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame. Vulnerabilidad de doble liberación en WebSocket Server (el módulo res_http_websocket) en Asterisk Open Source 11.x anterior a 11.14.2, 12.x anterior a 12.7.2, y 13.x anterior a 13.0.2 y Certified Asterisk 11.6 anterior a 11.6-cert9 permite a atacantes remotos causar una denegación de servicio (caída) mediante el envio de un Frame de longitud cero después de un Frame de longitud no cero. • http://advisories.mageia.org/MGASA-2015-0010.html http://downloads.asterisk.org/pub/security/AST-2014-019.html http://packetstormsecurity.com/files/129473/Asterisk-Project-Security-Advisory-AST-2014-019.html http://seclists.org/fulldisclosure/2014/Dec/48 http://secunia.com/advisories/60251 http://www.mandriva.com/security/advisories?name=MDVSA-2015:018 http://www.securityfocus.com/archive/1/534197/100/0/threaded http://www.securityfocus.com/bid/71607 http://www.securitytracker.com/id/ •
CVSS: 4.0EPSS: 1%CPEs: 16EXPL: 0CVE-2014-6609
https://notcve.org/view.php?id=CVE-2014-6609
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package. El módulo res_pjsip_pubsub en Asterisk Open Source 12.x anterior a 12.5.1 permite a usuarios remotos autenticados causar una denegación de servicio (caída) a través de cabeceras manipuladas en una solicitud SIP SUBSCRIBE para un paquete de eventos. • http://downloads.asterisk.org/pub/security/AST-2014-009.html • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 0CVE-2014-8414
https://notcve.org/view.php?id=CVE-2014-8414
ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service (channel hang and memory consumption) by causing transitions to be delayed, which triggers a state change from hung up to waiting for media. ConfBridge en Asterisk 11.x anterior a 11.14.1 y Certified Asterisk 11.6 anterior a 11.6-cert8 no maneja debida mente los cambios de estado, lo que permite a atacantes remotos causar una denegación de servicio (cuelgue de canal y consumo de memoria) al causar que transiciones se retrasen, lo que provoca un cambio de estado de estar colgado a estar esperado medios. • http://downloads.asterisk.org/pub/security/AST-2014-014.html http://seclists.org/fulldisclosure/2014/Nov/67 • CWE-399: Resource Management Errors •