CVSS: 6.5EPSS: 7%CPEs: 133EXPL: 0CVE-2012-3863
https://notcve.org/view.php?id=CVE-2012-3863
09 Jul 2012 — channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a provisional response to a SIP reINVITE request, which allows remote authenticated users to cause a denial of service (RTP port exhaustion) via sessions that lack final responses. Asterisk Open Source v1.8.x anterior a v1.... • http://downloads.asterisk.org/pub/security/AST-2012-010.html • CWE-399: Resource Management Errors •
CVSS: 5.3EPSS: 0%CPEs: 150EXPL: 0CVE-2009-0041
https://notcve.org/view.php?id=CVE-2009-0041
14 Jan 2009 — IAX2 in Asterisk Open Source 1.2.x before 1.2.31, 1.4.x before 1.4.23-rc4, and 1.6.x before 1.6.0.3-rc2; Business Edition A.x.x, B.x.x before B.2.5.7, C.1.x.x before C.1.10.4, and C.2.x.x before C.2.1.2.1; and s800i 1.2.x before 1.3.0 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames. IAX2 en Asterisk Open Source v1.2.x anterior a v1.2.31, v1.4.x anterior a v1.4.23-rc4, y v1.6.x anterior a v1.6.0.3-rc2; Bus... • http://downloads.digium.com/pub/security/AST-2009-001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 8%CPEs: 53EXPL: 1CVE-2008-2119 – Asterisk 1.2.x - SIP channel driver / in pedantic mode Remote Crash
https://notcve.org/view.php?id=CVE-2008-2119
04 Jun 2008 — Asterisk Open Source 1.0.x and 1.2.x before 1.2.29 and Business Edition A.x.x and B.x.x before B.2.5.3, when pedantic parsing (aka pedanticsipchecking) is enabled, allows remote attackers to cause a denial of service (daemon crash) via a SIP INVITE message that lacks a From header, related to invocations of the ast_uri_decode function, and improper handling of (1) an empty const string and (2) a NULL pointer. Asterisk Open Source 1.0.x y 1.2.x anterior 1.2.29 y Business Edition A.x.x y B.x.x anterior B.2.5.... • https://www.exploit-db.com/exploits/5749 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 1%CPEs: 137EXPL: 0CVE-2008-1923
https://notcve.org/view.php?id=CVE-2008-1923
23 Apr 2008 — The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "early audio" to an unverified source IP address of a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed NEW message. El IAX2 channel driver (chan_iax2) en Asterisk 1.2 anterior a la revisión 72630 y 1.4 anterior a la revisión 65679, cuando está configurado para permitir llamadas sin autentica... • http://bugs.digium.com/view.php?id=10078 • CWE-16: Configuration •
CVSS: 7.5EPSS: 3%CPEs: 145EXPL: 0CVE-2008-1897
https://notcve.org/view.php?id=CVE-2008-1897
23 Apr 2008 — The IAX2 channel driver (chan_iax2) in Asterisk Open Source 1.0.x, 1.2.x before 1.2.28, and 1.4.x before 1.4.19.1; Business Edition A.x.x, B.x.x before B.2.5.2, and C.x.x before C.1.8.1; AsteriskNOW before 1.0.3; Appliance Developer Kit 0.x.x; and s800i before 1.1.0.3, when configured to allow unauthenticated calls, does not verify that an ACK response contains a call number matching the server's reply to a NEW message, which allows remote attackers to cause a denial of service (traffic amplification) via a... • http://bugs.digium.com/view.php?id=10078 • CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 20%CPEs: 8EXPL: 3CVE-2008-1289 – Asterisk 1.4.x - RTP Codec Payload Handling Multiple Buffer Overflow Vulnerabilities
https://notcve.org/view.php?id=CVE-2008-1289
24 Mar 2008 — Multiple buffer overflows in Asterisk Open Source 1.4.x before 1.4.18.1 and 1.4.19-rc3, Open Source 1.6.x before 1.6.0-beta6, Business Edition C.x.x before C.1.6.1, AsteriskNOW 1.0.x before 1.0.2, Appliance Developer Kit before 1.4 revision 109386, and s800i 1.1.x before 1.1.0.2 allow remote attackers to (1) write a zero to an arbitrary memory location via a large RTP payload number, related to the ast_rtp_unset_m_type function in main/rtp.c; or (2) write certain integers to an arbitrary memory location via... • https://www.exploit-db.com/exploits/31440 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.1EPSS: 0%CPEs: 109EXPL: 0CVE-2008-1332
https://notcve.org/view.php?id=CVE-2008-1332
20 Mar 2008 — Unspecified vulnerability in Asterisk Open Source 1.2.x before 1.2.27, 1.4.x before 1.4.18.1 and 1.4.19-rc3; Business Edition A.x.x, B.x.x before B.2.5.1, and C.x.x before C.1.6.2; AsteriskNOW 1.0.x before 1.0.2; Appliance Developer Kit before 1.4 revision 109393; and s800i 1.0.x before 1.1.0.2; allows remote attackers to access the SIP channel driver via a crafted From header. Vulnerabilidad no especificada en Asterisk Open Source versiones 1.2.x anteriores a 1.2.27, 1.4.x anteriores a 1.4.18.1 y 1.4.19-rc... • http://downloads.digium.com/pub/security/AST-2008-003.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 31%CPEs: 5EXPL: 2CVE-2008-0095 – Asterisk 1.x - BYE Message Remote Denial of Service
https://notcve.org/view.php?id=CVE-2008-0095
08 Jan 2008 — The SIP channel driver in Asterisk Open Source 1.4.x before 1.4.17, Business Edition before C.1.0-beta8, AsteriskNOW before beta7, Appliance Developer Kit before Asterisk 1.4 revision 95946, and Appliance s800i 1.0.x before 1.0.3.4 allows remote attackers to cause a denial of service (daemon crash) via a BYE message with an Also (Also transfer) header, which triggers a NULL pointer dereference. El controlador de canal SIP de Asterisk Open Source 1.4.x versiones anteriores a 1.4.17, Business Edition versione... • https://www.exploit-db.com/exploits/30974 • CWE-399: Resource Management Errors •