CVE-2003-0761: Buffer Overflow
Buffer overflow in the getmsgtext of chansip.c in the Session Initiation Protocol (SIP) protocol implementation for Asterisk releases before August 15, 2003, allows remote attackers to execute arbitrary code via certain (1) MESSAGE or (2) INFO requests.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Block or filter SIP MESSAGE and SIP INFO requests directed at Asterisk servers at the network perimeter (e.g., firewall, SIP-aware SBC, or router ACL). Drop or reject incoming SIP packets with Method: MESSAGE or Method: INFO to prevent exploitation of the chan_sip get_msg_text buffer overflow.
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0761?
CVE-2003-0761 has a high severity rating due to its potential to allow remote code execution.
How do I fix CVE-2003-0761?
To fix CVE-2003-0761, upgrade to Asterisk version 1.2.14 or later.
What software is affected by CVE-2003-0761?
CVE-2003-0761 affects Asterisk versions prior to 1.2.14.
What type of vulnerability is CVE-2003-0761?
CVE-2003-0761 is classified as a buffer overflow vulnerability.
Can CVE-2003-0761 be exploited remotely?
Yes, CVE-2003-0761 can be exploited remotely through crafted MESSAGE or INFO requests.