CVE-2009-0871: Input Validation
The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service (crash) via a SIP INVITE request without any headers, which triggers a NULL pointer dereference in the (1) sipuriheaderscmp and (2) sipuriparamscmp functions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the 'pedantic' option for the SIP channel driver (i.e., set the pedantic option to disabled/false) to prevent NULL pointer dereference when processing SIP INVITE requests without headers.
Asterisk (SIP channel driver) pedantic option = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0871?
CVE-2009-0871 is rated as a high severity vulnerability due to its potential to cause a denial of service.
How do I fix CVE-2009-0871?
To mitigate CVE-2009-0871, upgrade to a patched version of Asterisk that is not vulnerable to this issue.
What versions of Asterisk are affected by CVE-2009-0871?
Affected versions include Asterisk Open Source 1.4.22, 1.4.23, and various 1.6 versions before 1.6.0.6.
What type of attack does CVE-2009-0871 involve?
CVE-2009-0871 involves an attack that can be executed via a specially crafted SIP INVITE request.
Who can exploit CVE-2009-0871?
CVE-2009-0871 can be exploited by remote authenticated users.