CVE-2012-0885: Null Pointer Dereference
First published: Fri Jan 20 2012(Updated: )
A denial of service flaw was found in the way asterisk processed certain requests to negotiate secure video stream, when the res_srtp Asterisk module has been loaded and video support has not been enabled. A remote attacker could provide a specially-crafted media stream negotiation request, which once processed by Asterisk would lead to asterisk daemon crash by processing crypto line for such media stream. References: [1] <a href="http://downloads.asterisk.org/pub/security/AST-2012-001.html">http://downloads.asterisk.org/pub/security/AST-2012-001.html</a> [2] <a href="https://issues.asterisk.org/jira/browse/ASTERISK-19202">https://issues.asterisk.org/jira/browse/ASTERISK-19202</a> Upstream patch against the v1.8.x branch: [3] <a href="http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff">http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff</a> Upstream patch against the v1.10.x branch: [4] <a href="http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff">http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff</a>
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Asterisk Open Source | =1.8.0 | |
| Asterisk Open Source | =1.8.0-beta1 | |
| Asterisk Open Source | =1.8.0-beta2 | |
| Asterisk Open Source | =1.8.0-beta3 | |
| Asterisk Open Source | =1.8.0-beta4 | |
| Asterisk Open Source | =1.8.0-beta5 | |
| Asterisk Open Source | =1.8.0-rc2 | |
| Asterisk Open Source | =1.8.0-rc3 | |
| Asterisk Open Source | =1.8.0-rc4 | |
| Asterisk Open Source | =1.8.0-rc5 | |
| Asterisk Open Source | =1.8.1 | |
| Asterisk Open Source | =1.8.1-rc1 | |
| Asterisk Open Source | =1.8.1.1 | |
| Asterisk Open Source | =1.8.1.2 | |
| Asterisk Open Source | =1.8.2 | |
| Asterisk Open Source | =1.8.2-rc1 | |
| Asterisk Open Source | =1.8.2.1 | |
| Asterisk Open Source | =1.8.2.2 | |
| Asterisk Open Source | =1.8.2.3 | |
| Asterisk Open Source | =1.8.2.4 | |
| Asterisk Open Source | =1.8.3 | |
| Asterisk Open Source | =1.8.3-rc1 | |
| Asterisk Open Source | =1.8.3-rc2 | |
| Asterisk Open Source | =1.8.3-rc3 | |
| Asterisk Open Source | =1.8.3.1 | |
| Asterisk Open Source | =1.8.3.2 | |
| Asterisk Open Source | =1.8.3.3 | |
| Asterisk Open Source | =1.8.4 | |
| Asterisk Open Source | =1.8.4-rc1 | |
| Asterisk Open Source | =1.8.4-rc2 | |
| Asterisk Open Source | =1.8.4-rc3 | |
| Asterisk Open Source | =1.8.4.1 | |
| Asterisk Open Source | =1.8.4.2 | |
| Asterisk Open Source | =1.8.4.3 | |
| Asterisk Open Source | =1.8.4.4 | |
| Asterisk Open Source | =1.8.5-rc1 | |
| Asterisk Open Source | =1.8.5.0 | |
| Asterisk Open Source | =1.8.6.0 | |
| Asterisk Open Source | =1.8.6.0-rc1 | |
| Asterisk Open Source | =1.8.6.0-rc2 | |
| Asterisk Open Source | =1.8.6.0-rc3 | |
| Asterisk Open Source | =1.8.7.0 | |
| Asterisk Open Source | =1.8.7.0-rc1 | |
| Asterisk Open Source | =1.8.7.0-rc2 | |
| Asterisk Open Source | =1.8.7.1 | |
| Asterisk Open Source | =1.8.7.2 | |
| Asterisk Open Source | =1.8.8.0 | |
| Asterisk Open Source | =1.8.8.0-rc1 | |
| Asterisk Open Source | =1.8.8.0-rc2 | |
| Asterisk Open Source | =1.8.8.0-rc3 | |
| Asterisk Open Source | =1.8.8.0-rc4 | |
| Asterisk Open Source | =1.8.8.0-rc5 | |
| Asterisk Open Source | =1.8.8.1 | |
| Asterisk Open Source | =10.0.0 | |
| Asterisk Open Source | =10.0.0-beta1 | |
| Asterisk Open Source | =10.0.0-beta2 | |
| Asterisk Open Source | =10.0.0-rc1 | |
| Asterisk Open Source | =10.0.0-rc2 | |
| Asterisk Open Source | =10.0.0-rc3 | |
| redhat/asterisk | <1.8.8.2 | 1.8.8.2 |
| redhat/asterisk | <10.0.1 | 10.0.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff
- http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff
- http://downloads.asterisk.org/pub/security/AST-2012-001.html
- http://www.openwall.com/lists/oss-security/2012/01/20/16
- http://www.openwall.com/lists/oss-security/2012/01/20/18
- https://bugzilla.redhat.com/show_bug.cgi?id=783487
- https://issues.asterisk.org/jira/browse/ASTERISK-19202
- https://issues.asterisk.org/jira/secure/attachment/42202/issueA19202_crypto_if_uninited_text_or_video.patch
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=783490
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=783491
- https://access.redhat.com/security/cve/CVE-2012-0885
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/author
- agent/description
- agent/tags
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2012-0885
- agent/software-canonical-lookup
- vendor/asterisk
- canonical/asterisk open source
- version/asterisk open source/1.8.0
- version/asterisk open source/1.8.0-beta1
- version/asterisk open source/1.8.0-beta2
- version/asterisk open source/1.8.0-beta3
- version/asterisk open source/1.8.0-beta4
- version/asterisk open source/1.8.0-beta5
- version/asterisk open source/1.8.0-rc2
- version/asterisk open source/1.8.0-rc3
- version/asterisk open source/1.8.0-rc4
- version/asterisk open source/1.8.0-rc5
- version/asterisk open source/1.8.1
- version/asterisk open source/1.8.1-rc1
- version/asterisk open source/1.8.1.1
- version/asterisk open source/1.8.1.2
- version/asterisk open source/1.8.2
- version/asterisk open source/1.8.2-rc1
- version/asterisk open source/1.8.2.1
- version/asterisk open source/1.8.2.2
- version/asterisk open source/1.8.2.3
- version/asterisk open source/1.8.2.4
- version/asterisk open source/1.8.3
- version/asterisk open source/1.8.3-rc1
- version/asterisk open source/1.8.3-rc2
- version/asterisk open source/1.8.3-rc3
- version/asterisk open source/1.8.3.1
- version/asterisk open source/1.8.3.2
- version/asterisk open source/1.8.3.3
- version/asterisk open source/1.8.4
- version/asterisk open source/1.8.4-rc1
- version/asterisk open source/1.8.4-rc2
- version/asterisk open source/1.8.4-rc3
- version/asterisk open source/1.8.4.1
- version/asterisk open source/1.8.4.2
- version/asterisk open source/1.8.4.3
- version/asterisk open source/1.8.4.4
- version/asterisk open source/1.8.5-rc1
- version/asterisk open source/1.8.5.0
- version/asterisk open source/1.8.6.0
- version/asterisk open source/1.8.6.0-rc1
- version/asterisk open source/1.8.6.0-rc2
- version/asterisk open source/1.8.6.0-rc3
- version/asterisk open source/1.8.7.0
- version/asterisk open source/1.8.7.0-rc1
- version/asterisk open source/1.8.7.0-rc2
- version/asterisk open source/1.8.7.1
- version/asterisk open source/1.8.7.2
- version/asterisk open source/1.8.8.0
- version/asterisk open source/1.8.8.0-rc1
- version/asterisk open source/1.8.8.0-rc2
- version/asterisk open source/1.8.8.0-rc3
- version/asterisk open source/1.8.8.0-rc4
- version/asterisk open source/1.8.8.0-rc5
- version/asterisk open source/1.8.8.1
- version/asterisk open source/10.0.0
- version/asterisk open source/10.0.0-beta1
- version/asterisk open source/10.0.0-beta2
- version/asterisk open source/10.0.0-rc1
- version/asterisk open source/10.0.0-rc2
- version/asterisk open source/10.0.0-rc3
- package-manager/redhat