CVSS: 4.3EPSS: 80%CPEs: 322EXPL: 0CVE-2015-3008
https://notcve.org/view.php?id=CVE-2015-3008
Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before 12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before 1.8.28-cert5, 11.6 before 11.6-cert11, and 13.1 before 13.1-cert2, when registering a SIP TLS device, does not properly handle a null byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. Asterisk Open Source 1.8 anterior a 1.8.32.3, 11.x anterior a 11.17.1, 12.x anterior a 12.8.2, y 13.x anterior a 13.3.2 y Certified Asterisk 1.8.28 anterior a 1.8.28-cert5, 11.6 anterior a 11.6-cert11, y 13.1 anterior a 13.1-cert2, cuando registra un dispositivo SIP TLS, no maneja correctamente un byte nulo en un nombre de dominio en el campo Common Name (CN) del sujeto de un certificado X.509, lo que permite a atacantes man-in-the-middle falsificar servidores SSL arbitrarios a través de un certificado manipulado emitido por una autoridad de certificación legítima. • http://advisories.mageia.org/MGASA-2015-0153.html http://downloads.asterisk.org/pub/security/AST-2015-003.html http://lists.fedoraproject.org/pipermail/package-announce/2015-July/162260.html http://packetstormsecurity.com/files/131364/Asterisk-Project-Security-Advisory-AST-2015-003.html http://seclists.org/fulldisclosure/2015/Apr/22 http://www.debian.org/security/2016/dsa-3700 http://www.mandriva.com/security/advisories?name=MDVSA-2015:206 http://www.securityfocus.com/archive/1/535222/100/0 • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 0CVE-2014-8412
https://notcve.org/view.php?id=CVE-2014-8412
The (1) VoIP channel drivers, (2) DUNDi, and (3) Asterisk Manager Interface (AMI) in Asterisk Open Source 1.8.x before 1.8.32.1, 11.x before 11.14.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8.28 before 1.8.28-cert3 and 11.6 before 11.6-cert8 allows remote attackers to bypass the ACL restrictions via a packet with a source IP that does not share the address family as the first ACL entry. (1) Los controladores de canales VoIP, (2) DUNDi, y (3) Asterisk Manager Interface (AMI) en Asterisk Open Source 1.8.x anterior a 1.8.32.1, 11.x anterior a 11.14.1, 12.x anterior a 12.7.1, y 13.x anterior a 13.0.1 y Certified Asterisk 1.8.28 anterior a 1.8.28-cert3 y 11.6 anterior a 11.6-cert8 permite a atacantes remotos evadir las restricciones ACL a través de un paquete con una fuente IP que no comparte la familia de direcciones como la primera entrada ACL. • http://downloads.asterisk.org/pub/security/AST-2014-012.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 0CVE-2014-8414
https://notcve.org/view.php?id=CVE-2014-8414
ConfBridge in Asterisk 11.x before 11.14.1 and Certified Asterisk 11.6 before 11.6-cert8 does not properly handle state changes, which allows remote attackers to cause a denial of service (channel hang and memory consumption) by causing transitions to be delayed, which triggers a state change from hung up to waiting for media. ConfBridge en Asterisk 11.x anterior a 11.14.1 y Certified Asterisk 11.6 anterior a 11.6-cert8 no maneja debida mente los cambios de estado, lo que permite a atacantes remotos causar una denegación de servicio (cuelgue de canal y consumo de memoria) al causar que transiciones se retrasen, lo que provoca un cambio de estado de estar colgado a estar esperado medios. • http://downloads.asterisk.org/pub/security/AST-2014-014.html http://seclists.org/fulldisclosure/2014/Nov/67 • CWE-399: Resource Management Errors •
CVSS: 9.0EPSS: 0%CPEs: 19EXPL: 0CVE-2014-8418
https://notcve.org/view.php?id=CVE-2014-8418
The DB dialplan function in Asterisk Open Source 1.8.x before 1.8.32, 11.x before 11.1.4.1, 12.x before 12.7.1, and 13.x before 13.0.1 and Certified Asterisk 1.8 before 1.8.28-cert8 and 11.6 before 11.6-cert8 allows remote authenticated users to gain privileges via a call from an external protocol, as demonstrated by the AMI protocol. La función DB dialplan en Asterisk Open Source 1.8.x anterior a 1.8.32, 11.x anterior a 11.1.4.1, 12.x anterior a 12.7.1, y 13.x anterior a 13.0.1 y Certified Asterisk 1.8 anterior a 1.8.28-cert8 y 11.6 anterior a 11.6-cert8 permite a usuarios remotos autenticados ganar privilegios a través de una llamada de un protocolo externo, tal y como fue demostrado por el protocolo AMI. • http://downloads.asterisk.org/pub/security/AST-2014-018.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2014-4048
https://notcve.org/view.php?id=CVE-2014-4048
The PJSIP Channel Driver in Asterisk Open Source before 12.3.1 allows remote attackers to cause a denial of service (deadlock) by terminating a subscription request before it is complete, which triggers a SIP transaction timeout. El controlador de canales PJSIP en Asterisk Open Source anterior a 12.3.1 permite a atacantes remotos causar una denegación de servicio (bloqueo) mediante la terminación de una solicitud de suscripción antes de que se haya completado, lo que provoca un timeout de la transacción SIP. • http://downloads.asterisk.org/pub/security/AST-2014-008.html http://packetstormsecurity.com/files/127090/Asterisk-Project-Security-Advisory-AST-2014-008.html http://www.securityfocus.com/archive/1/532416/100/0/threaded •