CVE-2011-2665: Null Pointer Dereference
Published Jul 6, 2011
·Updated
reqrespparser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a SIP packet with a Contact header that lacks a < (less than) character.
Affected Software
32 affected components
Asterisk=1.8.3-rc3
Asterisk=1.8.3
Asterisk=1.8.2.4
Asterisk=1.8.0-beta2
Asterisk=1.8.3-rc1
Asterisk=1.8.1
Asterisk=1.8.1.2
Asterisk=1.8.0-beta4
Asterisk=1.8.4-rc1
Asterisk=1.8.0-rc5
Asterisk=1.8.3.1
Asterisk=1.8.0-beta3
Asterisk=1.8.0-beta5
Asterisk=1.8.4
Asterisk=1.8.3.2
Asterisk=1.8.0-rc2
Asterisk=1.8.3-rc2
Asterisk=1.8.4.2
Asterisk=1.8.2.3
Asterisk=1.8.3.3
Asterisk=1.8.4-rc2
Asterisk=1.8.2.1
Asterisk=1.8.1-rc1
Asterisk=1.8.0
Asterisk=1.8.0-rc3
Asterisk=1.8.1.1
Asterisk=1.8.2
Asterisk=1.8.2.2
Asterisk=1.8.4-rc3
Asterisk=1.8.0-beta1
Asterisk=1.8.0-rc4
Asterisk=1.8.4.1
Remediation
Event History
Jul 6, 2011
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2011-2665?
CVE-2011-2665 is classified as a denial of service vulnerability which can lead to daemon crashes.
2
How do I fix CVE-2011-2665?
To fix CVE-2011-2665, upgrade Asterisk to version 1.8.4.3 or later.
3
What systems are affected by CVE-2011-2665?
CVE-2011-2665 affects various versions of Asterisk 1.8.x prior to 1.8.4.3.
4
What kind of attack does CVE-2011-2665 enable?
CVE-2011-2665 enables remote attackers to send a malformed SIP packet causing a denial of service.
5
Is CVE-2011-2665 exploitability easy or difficult?
The exploitability of CVE-2011-2665 is considered easy due to the nature of the vulnerability affecting SIP packets.