CVE-2013-5642
Mandriva Linux Security Advisory 2013-223
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
El controlador de canal SIP (channels/chan_sip.c) en Asterisk Open Source 1.8.x (anteriores a 1.8.23.1), 10.x (anteriores a 10.12.3), y 11.x (anteriores a 11.5.1); Certified Asterisk 1.8.15 (anteriores a 1.8.15-cert3) y 11.2 (anteriores a 11.2-cert2); y Asterisk Digiumphones 10.x-digiumphones (anteriores a 10.12.3-digiumphones) permiten a un atcante remoto causar una denegación de servicio (referencia a puntero nulo, corrupción de memoria, y caída del demonio) a través de un SDP inválido que define una descripción de medios antes de la descripción de conexión en una petición SIP.
A remotely exploitable crash vulnerability exists in the SIP channel driver if an ACK with SDP is received after the channel has been terminated. The handling code incorrectly assumes that the channel will always be present. A remotely exploitable crash vulnerability exists in the SIP channel driver if an invalid SDP is sent in a SIP request that defines media descriptions before connection information. The handling code incorrectly attempts to reference the socket address information even though that information has not yet been set.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2013-08-28 CVE Reserved
- 2013-08-30 CVE Published
- 2024-08-06 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2013-08/0174.html | Mailing List | |
| http://osvdb.org/96690 | Vdb Entry | |
| http://secunia.com/advisories/54617 | Third Party Advisory | |
| http://www.securityfocus.com/bid/62022 | Vdb Entry | |
| http://www.securitytracker.com/id/1028957 | Vdb Entry | |
| https://issues.asterisk.org/jira/browse/ASTERISK-22007 | X_refsource_confirm |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://downloads.asterisk.org/pub/security/AST-2013-005.html | 2013-09-12 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/54534 | 2013-09-12 | |
| http://www.debian.org/security/2013/dsa-2749 | 2013-09-12 | |
| http://www.mandriva.com/security/advisories?name=MDVSA-2013:223 | 2013-09-12 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.17.0 Search vendor "Digium" for product "Asterisk" and version "1.8.17.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.17.0 Search vendor "Digium" for product "Asterisk" and version "1.8.17.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.17.0 Search vendor "Digium" for product "Asterisk" and version "1.8.17.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.17.0 Search vendor "Digium" for product "Asterisk" and version "1.8.17.0" | rc3 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.18.0 Search vendor "Digium" for product "Asterisk" and version "1.8.18.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.18.0 Search vendor "Digium" for product "Asterisk" and version "1.8.18.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.18.1 Search vendor "Digium" for product "Asterisk" and version "1.8.18.1" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.19.0 Search vendor "Digium" for product "Asterisk" and version "1.8.19.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.19.0 Search vendor "Digium" for product "Asterisk" and version "1.8.19.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.19.0 Search vendor "Digium" for product "Asterisk" and version "1.8.19.0" | rc3 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.19.1 Search vendor "Digium" for product "Asterisk" and version "1.8.19.1" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.20.0 Search vendor "Digium" for product "Asterisk" and version "1.8.20.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.20.0 Search vendor "Digium" for product "Asterisk" and version "1.8.20.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.20.0 Search vendor "Digium" for product "Asterisk" and version "1.8.20.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.21.0 Search vendor "Digium" for product "Asterisk" and version "1.8.21.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.21.0 Search vendor "Digium" for product "Asterisk" and version "1.8.21.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.22.0 Search vendor "Digium" for product "Asterisk" and version "1.8.22.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.22.0 Search vendor "Digium" for product "Asterisk" and version "1.8.22.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.22.0 Search vendor "Digium" for product "Asterisk" and version "1.8.22.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.23.0 Search vendor "Digium" for product "Asterisk" and version "1.8.23.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.23.0 Search vendor "Digium" for product "Asterisk" and version "1.8.23.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 1.8.23.0 Search vendor "Digium" for product "Asterisk" and version "1.8.23.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.10.0 Search vendor "Digium" for product "Asterisk" and version "10.10.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.10.0 Search vendor "Digium" for product "Asterisk" and version "10.10.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.10.0 Search vendor "Digium" for product "Asterisk" and version "10.10.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.11.0 Search vendor "Digium" for product "Asterisk" and version "10.11.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.11.0 Search vendor "Digium" for product "Asterisk" and version "10.11.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.11.0 Search vendor "Digium" for product "Asterisk" and version "10.11.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.11.0 Search vendor "Digium" for product "Asterisk" and version "10.11.0" | rc3 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.12.0 Search vendor "Digium" for product "Asterisk" and version "10.12.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.12.0 Search vendor "Digium" for product "Asterisk" and version "10.12.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.12.0 Search vendor "Digium" for product "Asterisk" and version "10.12.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.12.1 Search vendor "Digium" for product "Asterisk" and version "10.12.1" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 10.12.2 Search vendor "Digium" for product "Asterisk" and version "10.12.2" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.0.0 Search vendor "Digium" for product "Asterisk" and version "11.0.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.0.0 Search vendor "Digium" for product "Asterisk" and version "11.0.0" | beta1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.0.0 Search vendor "Digium" for product "Asterisk" and version "11.0.0" | beta2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.0.0 Search vendor "Digium" for product "Asterisk" and version "11.0.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.0.0 Search vendor "Digium" for product "Asterisk" and version "11.0.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.0.1 Search vendor "Digium" for product "Asterisk" and version "11.0.1" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.0.2 Search vendor "Digium" for product "Asterisk" and version "11.0.2" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.1.0 Search vendor "Digium" for product "Asterisk" and version "11.1.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.1.0 Search vendor "Digium" for product "Asterisk" and version "11.1.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.1.0 Search vendor "Digium" for product "Asterisk" and version "11.1.0" | rc3 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.1.1 Search vendor "Digium" for product "Asterisk" and version "11.1.1" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.1.2 Search vendor "Digium" for product "Asterisk" and version "11.1.2" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.2.0 Search vendor "Digium" for product "Asterisk" and version "11.2.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.2.0 Search vendor "Digium" for product "Asterisk" and version "11.2.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.3.0 Search vendor "Digium" for product "Asterisk" and version "11.3.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.3.0 Search vendor "Digium" for product "Asterisk" and version "11.3.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.4.0 Search vendor "Digium" for product "Asterisk" and version "11.4.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.4.0 Search vendor "Digium" for product "Asterisk" and version "11.4.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.4.0 Search vendor "Digium" for product "Asterisk" and version "11.4.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.4.0 Search vendor "Digium" for product "Asterisk" and version "11.4.0" | rc3 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.5.0 Search vendor "Digium" for product "Asterisk" and version "11.5.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.5.0 Search vendor "Digium" for product "Asterisk" and version "11.5.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.5.0 Search vendor "Digium" for product "Asterisk" and version "11.5.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Search vendor "Digium" for product "Asterisk" | 11.5.1 Search vendor "Digium" for product "Asterisk" and version "11.5.1" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.0.0 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.0.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.0.0 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.0.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.0.0 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.0.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.11.0 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.11.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.11.0 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.11.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.11.0 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.11.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.11.0 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.11.0" | rc3 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.12.0 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.12.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.12.0 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.12.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.12.0 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.12.0" | rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.12.1 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.12.1" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Asterisk Digiumphones Search vendor "Digium" for product "Asterisk Digiumphones" | 10.12.2 Search vendor "Digium" for product "Asterisk Digiumphones" and version "10.12.2" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 1.8.15 Search vendor "Digium" for product "Certified Asterisk" and version "1.8.15" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 1.8.15 Search vendor "Digium" for product "Certified Asterisk" and version "1.8.15" | cert1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 1.8.15 Search vendor "Digium" for product "Certified Asterisk" and version "1.8.15" | cert1-rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 1.8.15 Search vendor "Digium" for product "Certified Asterisk" and version "1.8.15" | cert1-rc2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 1.8.15 Search vendor "Digium" for product "Certified Asterisk" and version "1.8.15" | cert1-rc3 |
Affected
| ||||||
| Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 1.8.15 Search vendor "Digium" for product "Certified Asterisk" and version "1.8.15" | cert2 |
Affected
| ||||||
| Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 1.8.15 Search vendor "Digium" for product "Certified Asterisk" and version "1.8.15" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 11.2.0 Search vendor "Digium" for product "Certified Asterisk" and version "11.2.0" | - |
Affected
| ||||||
| Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 11.2.0 Search vendor "Digium" for product "Certified Asterisk" and version "11.2.0" | cert1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 11.2.0 Search vendor "Digium" for product "Certified Asterisk" and version "11.2.0" | rc1 |
Affected
| ||||||
| Digium Search vendor "Digium" | Certified Asterisk Search vendor "Digium" for product "Certified Asterisk" | 11.2.0 Search vendor "Digium" for product "Certified Asterisk" and version "11.2.0" | rc2 |
Affected
| ||||||