Asterisk Uncompleted Re-invite Transactions Denial Of Service Vulnerability

Bugtraq ID:	54327
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2012-3863
Remote:	Yes
Local:	No
Published:	Jul 05 2012 12:00AM
Updated:	Apr 16 2015 05:51PM
Credit:	Steve Davies
Vulnerable:	Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Asterisk Certified Asterisk 1.8.11-cert2 Asterisk Certified Asterisk 1.8.11-cert1 Asterisk Asterisk Business Edition C.3.7.4 Asterisk Asterisk Business Edition C.3.7.3 Asterisk Asterisk Business Edition C.3.6.4 Asterisk Asterisk Business Edition C.3.6.3 Asterisk Asterisk Business Edition C.3.6.2 Asterisk Asterisk Business Edition C.3.3.2 Asterisk Asterisk Business Edition C.3.2 3 Asterisk Asterisk Business Edition C.3.2 2 Asterisk Asterisk Business Edition C.3.1.0 Asterisk Asterisk Business Edition C.3.1 1 Asterisk Asterisk 10.4.1 Asterisk Asterisk 10.3.1 Asterisk Asterisk 10.3.0 Asterisk Asterisk 1.8.12.1 Asterisk Asterisk 1.8.11.1 Asterisk Asterisk 1.8.11.0
Not Vulnerable:

Asterisk Uncompleted Re-invite Transactions Denial Of Service Vulnerability

Asterisk is prone to a remote denial-of-service vulnerability.

Attackers can exploit this issue to consume all the RTP (Realtime Transport Protocol) ports, resulting in a denial-of-service condition.

Asterisk Uncompleted Re-invite Transactions Denial Of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Asterisk Uncompleted Re-invite Transactions Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

Asterisk Uncompleted Re-invite Transactions Denial Of Service Vulnerability

References:

• Asterisk Homepage (Asterisk)