Asterisk IAX2 Channel Driver Denial Of Service Vulnerability

Bugtraq ID:	53722
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2012-2947
Remote:	Yes
Local:	No
Published:	May 29 2012 12:00AM
Updated:	Apr 13 2015 09:45PM
Credit:	mgrobecker
Vulnerable:	Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Asterisk Certified Asterisk 1.8.11-cert1 Asterisk Asterisk 10.0.1 Asterisk Asterisk 10.0 Asterisk Asterisk 1.8.8 2 Asterisk Asterisk 1.8.4 2 Asterisk Asterisk 1.8.4 1 Asterisk Asterisk 1.8.2 4 Asterisk Asterisk 1.8.1 Asterisk Asterisk 1.8 Asterisk Asterisk 10.3.1 Asterisk Asterisk 10.3.0 Asterisk Asterisk 10.2.1 Asterisk Asterisk 10.2.0 Asterisk Asterisk 10.0 Asterisk Asterisk 1.8.7.2 Asterisk Asterisk 1.8.7.1 Asterisk Asterisk 1.8.4.4 Asterisk Asterisk 1.8.4.3 Asterisk Asterisk 1.8.3.3 Asterisk Asterisk 1.8.3.1 Asterisk Asterisk 1.8.2.1 Asterisk Asterisk 1.8.11.1 Asterisk Asterisk 1.8.11.0 Asterisk Asterisk 1.8.10.1 Asterisk Asterisk 1.8.10.0 Asterisk Asterisk 1.8.1.2 Asterisk Asterisk 1.8
Not Vulnerable:	Asterisk Certified Asterisk 1.8.11-cert2 Asterisk Asterisk 10.4.1 Asterisk Asterisk 1.8.12.1

Asterisk IAX2 Channel Driver Denial Of Service Vulnerability

Asterisk is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the application to crash, denying service to legitimate users.

Asterisk IAX2 Channel Driver Denial Of Service Vulnerability

Attackers can use readily available tools to exploit this issue.

Asterisk IAX2 Channel Driver Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

Asterisk IAX2 Channel Driver Denial Of Service Vulnerability

References:

• Asterisk Homepage (Asterisk)
  
• Failure to pass NULL data pointer with AST_CONTROL_HOLD frame causes crash when (Asterisk)