Lucene search
HistoryApr 01, 2013 - 4:55 p.m.
CVE-2013-2686
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
6.2 Medium
AI Score
Confidence
Low
0.651 Medium
EPSS
Percentile
97.9%
main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which allows remote attackers to conduct stack-consumption attacks and cause a denial of service (daemon crash) via a crafted HTTP POST request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-5976.
Affected configurations
Node
asteriskopen_sourceMatch1.8.0
ORasteriskopen_sourceMatch1.8.0beta1
ORasteriskopen_sourceMatch1.8.0beta2
ORasteriskopen_sourceMatch1.8.0beta3
ORasteriskopen_sourceMatch1.8.0beta4
ORasteriskopen_sourceMatch1.8.0beta5
ORasteriskopen_sourceMatch1.8.0rc2
ORasteriskopen_sourceMatch1.8.0rc3
ORasteriskopen_sourceMatch1.8.0rc4
ORasteriskopen_sourceMatch1.8.0rc5
ORasteriskopen_sourceMatch1.8.1
ORasteriskopen_sourceMatch1.8.1rc1
ORasteriskopen_sourceMatch1.8.1.1
ORasteriskopen_sourceMatch1.8.1.2
ORasteriskopen_sourceMatch1.8.2
ORasteriskopen_sourceMatch1.8.2rc1
ORasteriskopen_sourceMatch1.8.2.1
ORasteriskopen_sourceMatch1.8.2.2
ORasteriskopen_sourceMatch1.8.2.3
ORasteriskopen_sourceMatch1.8.2.4
ORasteriskopen_sourceMatch1.8.3
ORasteriskopen_sourceMatch1.8.3rc1
ORasteriskopen_sourceMatch1.8.3rc2
ORasteriskopen_sourceMatch1.8.3rc3
ORasteriskopen_sourceMatch1.8.3.1
ORasteriskopen_sourceMatch1.8.3.2
ORasteriskopen_sourceMatch1.8.3.3
ORasteriskopen_sourceMatch1.8.4
ORasteriskopen_sourceMatch1.8.4rc1
ORasteriskopen_sourceMatch1.8.4rc2
ORasteriskopen_sourceMatch1.8.4rc3
ORasteriskopen_sourceMatch1.8.4.1
ORasteriskopen_sourceMatch1.8.4.2
ORasteriskopen_sourceMatch1.8.4.3
ORasteriskopen_sourceMatch1.8.4.4
ORasteriskopen_sourceMatch1.8.5rc1
ORasteriskopen_sourceMatch1.8.5.0
ORasteriskopen_sourceMatch1.8.6.0
ORasteriskopen_sourceMatch1.8.6.0rc1
ORasteriskopen_sourceMatch1.8.6.0rc2
ORasteriskopen_sourceMatch1.8.6.0rc3
ORasteriskopen_sourceMatch1.8.7.0
ORasteriskopen_sourceMatch1.8.7.0rc1
ORasteriskopen_sourceMatch1.8.7.0rc2
ORasteriskopen_sourceMatch1.8.7.1
ORasteriskopen_sourceMatch1.8.7.2
ORasteriskopen_sourceMatch1.8.8.0
ORasteriskopen_sourceMatch1.8.8.0rc1
ORasteriskopen_sourceMatch1.8.8.0rc2
ORasteriskopen_sourceMatch1.8.8.0rc3
ORasteriskopen_sourceMatch1.8.8.0rc4
ORasteriskopen_sourceMatch1.8.8.0rc5
ORasteriskopen_sourceMatch1.8.8.1
ORasteriskopen_sourceMatch1.8.8.2
ORasteriskopen_sourceMatch1.8.9.0
ORasteriskopen_sourceMatch1.8.9.0rc1
ORasteriskopen_sourceMatch1.8.9.0rc2
ORasteriskopen_sourceMatch1.8.9.0rc3
ORasteriskopen_sourceMatch1.8.9.1
ORasteriskopen_sourceMatch1.8.9.2
ORasteriskopen_sourceMatch1.8.9.3
ORasteriskopen_sourceMatch1.8.10.0
ORasteriskopen_sourceMatch1.8.10.0rc1
ORasteriskopen_sourceMatch1.8.10.0rc2
ORasteriskopen_sourceMatch1.8.10.0rc3
ORasteriskopen_sourceMatch1.8.10.0rc4
ORasteriskopen_sourceMatch1.8.10.1
ORasteriskopen_sourceMatch1.8.11.0
ORasteriskopen_sourceMatch1.8.11.0rc2
ORasteriskopen_sourceMatch1.8.11.0rc3
ORasteriskopen_sourceMatch1.8.11.1
ORasteriskopen_sourceMatch1.8.12
ORasteriskopen_sourceMatch1.8.12.0rc1
ORasteriskopen_sourceMatch1.8.12.0rc2
ORasteriskopen_sourceMatch1.8.12.0rc3
ORasteriskopen_sourceMatch1.8.12.1
ORasteriskopen_sourceMatch1.8.12.2
ORasteriskopen_sourceMatch1.8.13.0
ORasteriskopen_sourceMatch1.8.13.0rc1
ORasteriskopen_sourceMatch1.8.13.0rc2
ORasteriskopen_sourceMatch1.8.13.1
ORasteriskopen_sourceMatch1.8.14.0
ORasteriskopen_sourceMatch1.8.14.0rc1
ORasteriskopen_sourceMatch1.8.14.0rc2
ORasteriskopen_sourceMatch1.8.14.1
ORasteriskopen_sourceMatch1.8.15.0
ORasteriskopen_sourceMatch1.8.15.0rc1
ORasteriskopen_sourceMatch1.8.15.1
ORasteriskopen_sourceMatch1.8.16.0
ORasteriskopen_sourceMatch1.8.16.0rc1
ORasteriskopen_sourceMatch1.8.16.0rc2
ORasteriskopen_sourceMatch1.8.17.0
ORasteriskopen_sourceMatch1.8.17.0rc1
ORasteriskopen_sourceMatch1.8.17.0rc2
ORasteriskopen_sourceMatch1.8.17.0rc3
ORasteriskopen_sourceMatch1.8.18.0
ORasteriskopen_sourceMatch1.8.18.0rc1
ORasteriskopen_sourceMatch1.8.18.1
ORasteriskopen_sourceMatch1.8.19.0
ORasteriskopen_sourceMatch1.8.19.0rc1
ORasteriskopen_sourceMatch1.8.19.0rc3
ORasteriskopen_sourceMatch1.8.19.1
ORasteriskopen_sourceMatch1.8.20.0
ORasteriskopen_sourceMatch1.8.20.0rc1
ORasteriskopen_sourceMatch1.8.20.0rc2
ORasteriskopen_sourceMatch1.8.20.1
Node
asteriskopen_sourceMatch10.0.0
ORasteriskopen_sourceMatch10.0.0beta1
ORasteriskopen_sourceMatch10.0.0beta2
ORasteriskopen_sourceMatch10.0.0rc1
ORasteriskopen_sourceMatch10.0.0rc2
ORasteriskopen_sourceMatch10.0.0rc3
ORasteriskopen_sourceMatch10.0.1
ORasteriskopen_sourceMatch10.1.0
ORasteriskopen_sourceMatch10.1.0rc1
ORasteriskopen_sourceMatch10.1.0rc2
ORasteriskopen_sourceMatch10.1.1
ORasteriskopen_sourceMatch10.1.2
ORasteriskopen_sourceMatch10.1.3
ORasteriskopen_sourceMatch10.2.0
ORasteriskopen_sourceMatch10.2.0rc1
ORasteriskopen_sourceMatch10.2.0rc2
ORasteriskopen_sourceMatch10.2.0rc3
ORasteriskopen_sourceMatch10.2.0rc4
ORasteriskopen_sourceMatch10.2.1
ORasteriskopen_sourceMatch10.3.0
ORasteriskopen_sourceMatch10.3.0rc2
ORasteriskopen_sourceMatch10.3.0rc3
ORasteriskopen_sourceMatch10.3.1
ORasteriskopen_sourceMatch10.4.0
ORasteriskopen_sourceMatch10.4.0rc1
ORasteriskopen_sourceMatch10.4.0rc2
ORasteriskopen_sourceMatch10.4.0rc3
ORasteriskopen_sourceMatch10.4.1
ORasteriskopen_sourceMatch10.4.2
ORasteriskopen_sourceMatch10.5.0
ORasteriskopen_sourceMatch10.5.0rc1
ORasteriskopen_sourceMatch10.5.0rc2
ORasteriskopen_sourceMatch10.5.1
ORasteriskopen_sourceMatch10.5.2
ORasteriskopen_sourceMatch10.6.0
ORasteriskopen_sourceMatch10.6.0rc1
ORasteriskopen_sourceMatch10.6.0rc2
ORasteriskopen_sourceMatch10.6.1
ORasteriskopen_sourceMatch10.7.0
ORasteriskopen_sourceMatch10.7.0rc1
ORasteriskopen_sourceMatch10.7.1
ORasteriskopen_sourceMatch10.8.0
ORasteriskopen_sourceMatch10.8.0rc1
ORasteriskopen_sourceMatch10.8.0rc2
ORasteriskopen_sourceMatch10.9.0
ORasteriskopen_sourceMatch10.9.0rc1
ORasteriskopen_sourceMatch10.9.0rc2
ORasteriskopen_sourceMatch10.9.0rc3
ORasteriskopen_sourceMatch10.10.0
ORasteriskopen_sourceMatch10.10.0rc1
ORasteriskopen_sourceMatch10.10.0rc2
ORasteriskopen_sourceMatch10.10.1
ORasteriskopen_sourceMatch10.11.0
ORasteriskopen_sourceMatch10.11.0rc1
ORasteriskopen_sourceMatch10.11.0rc3
ORasteriskopen_sourceMatch10.11.1
ORasteriskopen_sourceMatch10.12.0
ORasteriskopen_sourceMatch10.12.0rc1
ORasteriskopen_sourceMatch10.12.0rc2
ORasteriskopen_sourceMatch10.12.1
Node
asteriskopen_sourceMatch11.0.0
ORasteriskopen_sourceMatch11.0.0beta1
ORasteriskopen_sourceMatch11.0.0beta2
ORasteriskopen_sourceMatch11.0.0rc1
ORasteriskopen_sourceMatch11.0.0rc2
ORasteriskopen_sourceMatch11.0.1
ORasteriskopen_sourceMatch11.0.2
ORasteriskopen_sourceMatch11.1.0
ORasteriskopen_sourceMatch11.1.0rc1
ORasteriskopen_sourceMatch11.1.0rc3
ORasteriskopen_sourceMatch11.1.1
ORasteriskopen_sourceMatch11.1.2
ORasteriskopen_sourceMatch11.2.0
ORasteriskopen_sourceMatch11.2.0rc1
ORasteriskopen_sourceMatch11.2.0rc2
ORasteriskopen_sourceMatch11.2.1
Node
asteriskcertified_asteriskMatch1.8.15cert1
ORasteriskcertified_asteriskMatch1.8.15cert1rc1
ORasteriskcertified_asteriskMatch1.8.15cert1rc2
ORasteriskcertified_asteriskMatch1.8.15cert1rc3
ORasteriskcertified_asteriskMatch1.8.15.0
ORasteriskcertified_asteriskMatch1.8.15.0rc1
Node
asteriskdigiumphonesMatch10.0.0
ORasteriskdigiumphonesMatch10.0.0beta1
ORasteriskdigiumphonesMatch10.0.0beta2
ORasteriskdigiumphonesMatch10.0.0rc1
ORasteriskdigiumphonesMatch10.0.0rc2
ORasteriskdigiumphonesMatch10.0.0rc3
ORasteriskdigiumphonesMatch10.1.0
ORasteriskdigiumphonesMatch10.1.0rc1
ORasteriskdigiumphonesMatch10.1.0rc2
ORasteriskdigiumphonesMatch10.2.0
ORasteriskdigiumphonesMatch10.2.0rc1
ORasteriskdigiumphonesMatch10.2.0rc2
ORasteriskdigiumphonesMatch10.2.0rc3
ORasteriskdigiumphonesMatch10.2.0rc4
ORasteriskdigiumphonesMatch10.3.0
ORasteriskdigiumphonesMatch10.3.0rc2
ORasteriskdigiumphonesMatch10.3.0rc3
ORasteriskdigiumphonesMatch10.4.0
ORasteriskdigiumphonesMatch10.4.0rc1
ORasteriskdigiumphonesMatch10.4.0rc2
ORasteriskdigiumphonesMatch10.4.0rc3
ORasteriskdigiumphonesMatch10.5.0
ORasteriskdigiumphonesMatch10.5.0rc1
ORasteriskdigiumphonesMatch10.5.0rc2
ORasteriskdigiumphonesMatch10.6.0
ORasteriskdigiumphonesMatch10.6.0rc1
ORasteriskdigiumphonesMatch10.6.0rc2
ORasteriskdigiumphonesMatch10.7.0
ORasteriskdigiumphonesMatch10.7.0rc1
ORasteriskdigiumphonesMatch10.8.0
ORasteriskdigiumphonesMatch10.8.0rc1
ORasteriskdigiumphonesMatch10.8.0rc2
ORasteriskdigiumphonesMatch10.9.0rc1
ORasteriskdigiumphonesMatch10.10.0
ORasteriskdigiumphonesMatch10.10.0rc1
ORasteriskdigiumphonesMatch10.10.0rc2
ORasteriskdigiumphonesMatch10.11.0
ORasteriskdigiumphonesMatch10.11.0rc1
ORasteriskdigiumphonesMatch10.11.0rc2
ORasteriskdigiumphonesMatch10.11.0rc3
ORasteriskdigiumphonesMatch10.12.0
ORasteriskdigiumphonesMatch10.12.0rc1
ORasteriskdigiumphonesMatch10.12.0rc2
ORasteriskdigiumphonesMatch10.12.1
Related
cve
cve
CVE-2013-2686
2022-10-03 16:14:59
CVE-2012-5976
2013-01-04 11:52:14
cvelist
cvelist
CVE-2013-2686
2022-10-03 16:14:59
CVE-2012-5976
2013-01-04 11:00:00
checkpoint_advisories
checkpoint_advisories
prion
prion
Design/Logic Flaw
2013-04-01 16:55:00
Stack overflow
2013-01-04 11:52:00
ubuntucve
ubuntucve
CVE-2013-2686
2013-04-01 00:00:00
CVE-2012-5976
2013-01-04 00:00:00
debiancve
debiancve
CVE-2013-2686
2022-10-03 16:14:59
CVE-2012-5976
2013-01-04 11:52:14
nessus
nessus
Mandriva Linux Security Advisory : asterisk (MDVSA-2013:140)
2013-04-20 00:00:00
Asterisk HTTP Content-Length Header DoS (AST-2013-002)
2013-04-10 00:00:00
Fedora 16 : asterisk-1.8.20.0-1.fc16 (2013-0992)
2013-01-31 00:00:00
nvd
nvd
CVE-2012-5976
2013-01-04 11:52:14
securityvulns
securityvulns
AST-2012-014: Crashes due to large stack allocations when using TCP
2013-01-05 00:00:00
AST-2013-002: Denial of Service in HTTP server
2013-04-01 00:00:00
Asterisk security vulnerabilities
2013-01-05 00:00:00
openvas
openvas
Fedora Update for asterisk FEDORA-2013-1003
2013-01-31 00:00:00
Fedora Update for asterisk FEDORA-2013-0992
2013-01-31 00:00:00
Debian: Security Advisory (DSA-2605-1)
2013-01-18 00:00:00
fedora
fedora
[SECURITY] Fedora 18 Update: asterisk-11.2.0-1.fc18
2013-01-30 00:33:07
[SECURITY] Fedora 16 Update: asterisk-1.8.20.0-1.fc16
2013-01-30 00:55:24
[SECURITY] Fedora 17 Update: asterisk-10.12.0-1.fc17
2013-01-30 00:36:44
debian
debian
[SECURITY] [DSA 2605-2] asterisk regression update
2013-01-19 14:01:19
[SECURITY] [DSA 2605-1] asterisk security update
2013-01-13 20:36:39
freebsd
freebsd
asterisk -- multiple vulnerabilities
2013-01-02 00:00:00
asterisk -- multiple vulnerabilities
2013-03-27 00:00:00
osv
osv
asterisk - several issues
2013-01-19 00:00:00
gentoo
gentoo
Asterisk: Multiple vulnerabilities
2014-01-21 00:00:00
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
6.2 Medium
AI Score
Confidence
Low
0.651 Medium
EPSS
Percentile
97.9%
Related for NVD:CVE-2013-2686