CVE-2012-0885
Severity Score
4.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SDP message with a crypto attribute and a (1) video or (2) text media type, as demonstrated by CSipSimple.
chan_sip.c en Asterisk Open Source v1.8.x antes de v1.8.8.2 y v10.x antes de v10.0.1 , cuando se usa el módulo res_srtp y el soporte multimedia esta incorrectamente configurado, permite a atacantes remotos provocar una denegación de servicio (puntero a NULL y caída del demonio) a través de un mensaje SDP específicamente modificado con un atributo de cifrado y (1) un vídeo o (2) el tipo de medio 'text'. Esto queda demostrado con CSipSimple.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2012-01-19 CVE Reserved
- 2012-01-25 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-16 First Exploit
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
CAPEC
References (8)
| URL | Tag | Source |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2012/01/20/16 | Mailing List |
|
| http://www.openwall.com/lists/oss-security/2012/01/20/18 | Mailing List |
|
| https://bugzilla.redhat.com/show_bug.cgi?id=783487 | X_refsource_confirm | |
| https://issues.asterisk.org/jira/browse/ASTERISK-19202 | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| https://issues.asterisk.org/jira/secure/attachment/42202/issueA19202_crypto_if_uninited_text_or_video.patch | 2024-09-16 |
| URL | Date | SRC |
|---|---|---|
| http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff | 2012-01-26 | |
| http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff | 2012-01-26 |
| URL | Date | SRC |
|---|---|---|
| http://downloads.asterisk.org/pub/security/AST-2012-001.html | 2012-01-26 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.0" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.0" | beta1 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.0" | beta2 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.0" | beta3 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.0" | beta4 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.0" | beta5 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.0" | rc2 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.0" | rc3 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.0" | rc4 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.0" | rc5 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.1 Search vendor "Asterisk" for product "Open Source" and version "1.8.1" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.1 Search vendor "Asterisk" for product "Open Source" and version "1.8.1" | rc1 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.1.1 Search vendor "Asterisk" for product "Open Source" and version "1.8.1.1" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.1.2 Search vendor "Asterisk" for product "Open Source" and version "1.8.1.2" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.2 Search vendor "Asterisk" for product "Open Source" and version "1.8.2" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.2 Search vendor "Asterisk" for product "Open Source" and version "1.8.2" | rc1 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.2.1 Search vendor "Asterisk" for product "Open Source" and version "1.8.2.1" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.2.2 Search vendor "Asterisk" for product "Open Source" and version "1.8.2.2" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.2.3 Search vendor "Asterisk" for product "Open Source" and version "1.8.2.3" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.2.4 Search vendor "Asterisk" for product "Open Source" and version "1.8.2.4" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.3 Search vendor "Asterisk" for product "Open Source" and version "1.8.3" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.3 Search vendor "Asterisk" for product "Open Source" and version "1.8.3" | rc1 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.3 Search vendor "Asterisk" for product "Open Source" and version "1.8.3" | rc2 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.3 Search vendor "Asterisk" for product "Open Source" and version "1.8.3" | rc3 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.3.1 Search vendor "Asterisk" for product "Open Source" and version "1.8.3.1" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.3.2 Search vendor "Asterisk" for product "Open Source" and version "1.8.3.2" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.3.3 Search vendor "Asterisk" for product "Open Source" and version "1.8.3.3" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.4 Search vendor "Asterisk" for product "Open Source" and version "1.8.4" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.4 Search vendor "Asterisk" for product "Open Source" and version "1.8.4" | rc1 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.4 Search vendor "Asterisk" for product "Open Source" and version "1.8.4" | rc2 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.4 Search vendor "Asterisk" for product "Open Source" and version "1.8.4" | rc3 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.4.1 Search vendor "Asterisk" for product "Open Source" and version "1.8.4.1" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.4.2 Search vendor "Asterisk" for product "Open Source" and version "1.8.4.2" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.4.3 Search vendor "Asterisk" for product "Open Source" and version "1.8.4.3" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.4.4 Search vendor "Asterisk" for product "Open Source" and version "1.8.4.4" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.5 Search vendor "Asterisk" for product "Open Source" and version "1.8.5" | rc1 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.5.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.5.0" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.6.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.6.0" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.6.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.6.0" | rc1 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.6.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.6.0" | rc2 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.6.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.6.0" | rc3 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.7.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.7.0" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.7.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.7.0" | rc1 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.7.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.7.0" | rc2 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.7.1 Search vendor "Asterisk" for product "Open Source" and version "1.8.7.1" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.7.2 Search vendor "Asterisk" for product "Open Source" and version "1.8.7.2" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.8.0" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.8.0" | rc1 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.8.0" | rc2 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.8.0" | rc3 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.8.0" | rc4 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.8.0 Search vendor "Asterisk" for product "Open Source" and version "1.8.8.0" | rc5 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 1.8.8.1 Search vendor "Asterisk" for product "Open Source" and version "1.8.8.1" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 10.0.0 Search vendor "Asterisk" for product "Open Source" and version "10.0.0" | - |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 10.0.0 Search vendor "Asterisk" for product "Open Source" and version "10.0.0" | beta1 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 10.0.0 Search vendor "Asterisk" for product "Open Source" and version "10.0.0" | beta2 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 10.0.0 Search vendor "Asterisk" for product "Open Source" and version "10.0.0" | rc1 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 10.0.0 Search vendor "Asterisk" for product "Open Source" and version "10.0.0" | rc2 |
Affected
| ||||||
| Asterisk Search vendor "Asterisk" | Open Source Search vendor "Asterisk" for product "Open Source" | 10.0.0 Search vendor "Asterisk" for product "Open Source" and version "10.0.0" | rc3 |
Affected
| ||||||