// For flags

CVE-2009-0871

 

Severity Score

3.5
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service (crash) via a SIP INVITE request without any headers, which triggers a NULL pointer dereference in the (1) sip_uri_headers_cmp and (2) sip_uri_params_cmp functions.

El controlador de canal SIP en Asterisk Open Source v1.4.22, v1.4.23, y v1.4.23.1; v1.6.0 anterior a v1.6.0.6; v1.6.1 anterior a v1.6.1.0-rc2; y Asterisk Business Edition C.2.3, con la opción "pedantic" activada, permite a usuarios autenticados remotamente provocar una denegación de servicio (caída) a travñes de una petición SIP INVITE sin cabecera, lo que dispara una deferencia a puntero NULL en las funciones (1) sip_uri_headers_cmp y(2) sip_uri_params_cmp.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2009-03-11 CVE Reserved
  • 2009-03-11 CVE Published
  • 2024-07-08 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.4.22
Search vendor "Digium" for product "Asterisk" and version "1.4.22"
-
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.4.23
Search vendor "Digium" for product "Asterisk" and version "1.4.23"
-
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.4.23.1
Search vendor "Digium" for product "Asterisk" and version "1.4.23.1"
-
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
-
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
beta1
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
beta2
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
beta3
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
beta4
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
beta5
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
beta6
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
beta7
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
beta7.1
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
beta8
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
beta9
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
rc4
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
rc5
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0
Search vendor "Digium" for product "Asterisk" and version "1.6.0"
rc6
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0.1
Search vendor "Digium" for product "Asterisk" and version "1.6.0.1"
-
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0.2
Search vendor "Digium" for product "Asterisk" and version "1.6.0.2"
-
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0.3
Search vendor "Digium" for product "Asterisk" and version "1.6.0.3"
-
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0.3
Search vendor "Digium" for product "Asterisk" and version "1.6.0.3"
rc1
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0.4
Search vendor "Digium" for product "Asterisk" and version "1.6.0.4"
rc1
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.0.5
Search vendor "Digium" for product "Asterisk" and version "1.6.0.5"
-
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.1
Search vendor "Digium" for product "Asterisk" and version "1.6.1"
-
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.1
Search vendor "Digium" for product "Asterisk" and version "1.6.1"
beta1
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.1
Search vendor "Digium" for product "Asterisk" and version "1.6.1"
beta2
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.1
Search vendor "Digium" for product "Asterisk" and version "1.6.1"
beta3
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.1
Search vendor "Digium" for product "Asterisk" and version "1.6.1"
beta4
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
1.6.1
Search vendor "Digium" for product "Asterisk" and version "1.6.1"
rc1
Affected
Digium
Search vendor "Digium"
Asterisk
Search vendor "Digium" for product "Asterisk"
c.2.3
Search vendor "Digium" for product "Asterisk" and version "c.2.3"
business
Affected