CVE-2014-2289

2014-04-1822:14:38

CWE-20

mitre

web.nvd.nist.gov

asterisk

open source

12.x

denial of service

vulnerability

nvd

cve-2014-2289

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:N/I:N/A:P

AI Score

6.1

Confidence

Low

EPSS

0.059

Percentile

93.5%

JSON

res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.

Affected configurations

Nvd

Node

digiumasteriskMatch12.0.0

digiumasteriskMatch12.1.0rc1

digiumasteriskMatch12.1.0rc2

digiumasteriskMatch12.1.0rc3

VendorProductVersionCPE
digiumasterisk12.0.0cpe:2.3:a:digium:asterisk:12.0.0:*:*:*:*:*:*:*
digiumasterisk12.1.0cpe:2.3:a:digium:asterisk:12.1.0:rc1:*:*:*:*:*:*
digiumasterisk12.1.0cpe:2.3:a:digium:asterisk:12.1.0:rc2:*:*:*:*:*:*
digiumasterisk12.1.0cpe:2.3:a:digium:asterisk:12.1.0:rc3:*:*:*:*:*:*

Vendor	Product	Version	CPE
digium	asterisk	12.0.0	cpe:2.3:a:digium:asterisk:12.0.0:::::::*
digium	asterisk	12.1.0	cpe:2.3:a:digium:asterisk:12.1.0:rc1::::::
digium	asterisk	12.1.0	cpe:2.3:a:digium:asterisk:12.1.0:rc2::::::
digium	asterisk	12.1.0	cpe:2.3:a:digium:asterisk:12.1.0:rc3::::::