CVE-2011-4598: Infoleak

Published Dec 15, 2011

Updated

The handlerequestinfo function in channels/chansip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted sequence of SIP requests.

Affected Software

80 affected components

Asterisk=1.8.0

Asterisk=1.8.0-beta1

Asterisk=1.8.0-beta2

Asterisk=1.8.0-beta3

Asterisk=1.8.0-beta4

Asterisk=1.8.0-beta5

Asterisk=1.8.0-rc2

Asterisk=1.8.0-rc3

Asterisk=1.8.0-rc4

Asterisk=1.8.0-rc5

Asterisk=1.8.1

Asterisk=1.8.1-rc1

Asterisk=1.8.1.1

Asterisk=1.8.1.2

Asterisk=1.8.2

Asterisk=1.8.2.1

Asterisk=1.8.2.2

Asterisk=1.8.2.3

Asterisk=1.8.2.4

Asterisk=1.8.3

Asterisk=1.8.3-rc1

Asterisk=1.8.3-rc2

Asterisk=1.8.3-rc3

Asterisk=1.8.3.1

Asterisk=1.8.3.2

Asterisk=1.8.3.3

Asterisk=1.8.4

Asterisk=1.8.4-rc1

Asterisk=1.8.4-rc2

Asterisk=1.8.4-rc3

Asterisk=1.8.4.1

Asterisk=1.8.4.2

Asterisk=1.8.4.3

Asterisk=1.8.4.4

Asterisk=1.8.5

Asterisk=1.8.5-rc1

Asterisk=1.8.5.0

Asterisk=1.8.6.0

Asterisk=1.8.6.0-rc1

Asterisk=1.8.6.0-rc2

Asterisk=1.8.6.0-rc3

Asterisk=1.8.7.0

Asterisk=1.8.7.0-rc1

Asterisk=1.8.7.0-rc2

Asterisk=1.8.7.1

Asterisk=1.6.2.0

Asterisk=1.6.2.0-rc2

Asterisk=1.6.2.0-rc3

Asterisk=1.6.2.0-rc4

Asterisk=1.6.2.0-rc5

Asterisk=1.6.2.0-rc6

Asterisk=1.6.2.0-rc7

Asterisk=1.6.2.0-rc8

Asterisk=1.6.2.1

Asterisk=1.6.2.1-rc1

Asterisk=1.6.2.2

Asterisk=1.6.2.3-rc2

Asterisk=1.6.2.4

Asterisk=1.6.2.5

Asterisk=1.6.2.6

Asterisk=1.6.2.6-rc1

Asterisk=1.6.2.6-rc2

Asterisk=1.6.2.15-rc1

Asterisk=1.6.2.16

Asterisk=1.6.2.16-rc1

Asterisk=1.6.2.16.1

Asterisk=1.6.2.16.2

Asterisk=1.6.2.17

Asterisk=1.6.2.17-rc1

Asterisk=1.6.2.17-rc2

Asterisk=1.6.2.17-rc3

Asterisk=1.6.2.17.1

Asterisk=1.6.2.17.2

Asterisk=1.6.2.17.3

Asterisk=1.6.2.18

Asterisk=1.6.2.18-rc1

Asterisk=1.6.2.19

Asterisk=1.6.2.19-rc1

Asterisk=1.6.2.20

Asterisk=1.6.2.21

Event History

Dec 15, 2011

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2011-4598?

CVE-2011-4598 has a severity that may lead to a denial of service, causing the Asterisk service to crash.

How do I fix CVE-2011-4598?

To fix CVE-2011-4598, upgrade Asterisk to version 1.6.2.21 or 1.8.7.2 or later.

What software is affected by CVE-2011-4598?

Asterisk Open Source versions 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2 are affected by CVE-2011-4598.

Can CVE-2011-4598 be exploited remotely?

Yes, CVE-2011-4598 can be exploited by remote attackers through crafted SIP requests.

What is the impact of exploiting CVE-2011-4598?

Exploiting CVE-2011-4598 can lead to a null pointer dereference and result in a crash of the Asterisk daemon.