CVE-2011-1507: Medium severity asterisk vulnerability
Asterisk did not limit the number of unauthenticated connections to vulnerable interfaces and did not limit the time unauthenticated clients remain connected to some interfaces. A remote attacker could open many subsequent connections to vulnerable Asterisk interfaces, leading to file descriptor resource exhaustion or possibly to disk space exhaustion (due Asterisk feature of logging failures to open new file descriptors into its log file).
References: [1] http://downloads.asterisk.org/pub/security/AST-2011-005.html
Upstream patches: [2] http://downloads.asterisk.org/pub/security/AST-2011-005-1.4.diff (against v1.4 branch) [3] http://downloads.asterisk.org/pub/security/AST-2011-005-1.6.1.diff (against v1.6.1 branch) [4] http://downloads.asterisk.org/pub/security/AST-2011-005-1.6.2.diff (against v1.6.2 branch) [5] http://downloads.asterisk.org/pub/security/AST-2011-005-1.8.diff (against v1.8 branch)
Other sources
Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial of service (file descriptor exhaustion and disk space exhaustion) via a series of TCP connections.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1507?
CVE-2011-1507 is classified as a high severity vulnerability due to the potential for remote attackers to exhaust server resources.
How do I fix CVE-2011-1507?
To fix CVE-2011-1507, you should update to a patched version of Asterisk that limits unauthenticated connections and their duration.
Which versions of Asterisk are affected by CVE-2011-1507?
CVE-2011-1507 affects multiple versions of Asterisk, particularly those in the 1.4.x ranges up to 1.4.39.
What are the potential impacts of CVE-2011-1507?
The impacts of CVE-2011-1507 can include service disruption due to resource exhaustion, potentially leading to denial of service.
Is there a workaround for CVE-2011-1507?
A temporary workaround for CVE-2011-1507 is to implement network-level filtering to limit connections to vulnerable Asterisk interfaces.