Lucene search

K
mageiaGentoo FoundationMGASA-2014-0172
HistoryApr 15, 2014 - 10:22 p.m.

Updated asterisk packages fix security vulnerabilities

2014-04-1522:22:45
Gentoo Foundation
advisories.mageia.org
16

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.63 Medium

EPSS

Percentile

97.9%

Updated asterisk packages fix security vulnerabilities: In Asterisk before 11.8.1, sending a HTTP request that is handled by Asterisk with a large number of Cookie headers could overflow the stack. You could even exhaust memory if you sent an unlimited number of headers in the request (CVE-2014-2286). In Asterisk before 11.8.1, an attacker can use all available file descriptors using SIP INVITE requests. Each INVITE meeting certain conditions will leak a channel and several file descriptors. The file descriptors cannot be released without restarting Asterisk which may allow intrusion detection systems to be bypassed by sending the requests slowly (CVE-2014-2287).

OSVersionArchitecturePackageVersionFilename
Mageia4noarchasterisk< 11.8.1-1asterisk-11.8.1-1.mga4

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.63 Medium

EPSS

Percentile

97.9%