CVE-2012-2415: Buffer Overflow
Published Apr 30, 2012
·Updated
Heap-based buffer overflow in chanskinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a series of KEYPADBUTTONMESSAGE events.
Affected Software
153 affected components
Asterisk Open Source=1.6.2.0
Asterisk Open Source=1.6.2.0-rc2
Asterisk Open Source=1.6.2.0-rc3
Asterisk Open Source=1.6.2.0-rc4
Asterisk Open Source=1.6.2.0-rc5
Asterisk Open Source=1.6.2.0-rc6
Asterisk Open Source=1.6.2.0-rc7
Asterisk Open Source=1.6.2.0-rc8
Asterisk Open Source=1.6.2.1
Asterisk Open Source=1.6.2.1-rc1
Asterisk Open Source=1.6.2.2
Asterisk Open Source=1.6.2.3-rc2
Asterisk Open Source=1.6.2.4
Asterisk Open Source=1.6.2.5
Asterisk Open Source=1.6.2.6
Asterisk Open Source=1.6.2.6-rc1
Asterisk Open Source=1.6.2.6-rc2
Asterisk Open Source=1.6.2.7
Asterisk Open Source=1.6.2.7-rc1
Asterisk Open Source=1.6.2.7-rc2
Asterisk Open Source=1.6.2.7-rc3
Asterisk Open Source=1.6.2.8
Asterisk Open Source=1.6.2.8-rc1
Asterisk Open Source=1.6.2.9
Asterisk Open Source=1.6.2.9-rc1
Asterisk Open Source=1.6.2.9-rc2
Asterisk Open Source=1.6.2.9-rc3
Asterisk Open Source=1.6.2.10
Asterisk Open Source=1.6.2.10-rc1
Asterisk Open Source=1.6.2.10-rc2
Asterisk Open Source=1.6.2.11
Asterisk Open Source=1.6.2.11-rc1
Asterisk Open Source=1.6.2.11-rc2
Asterisk Open Source=1.6.2.12
Asterisk Open Source=1.6.2.12-rc1
Asterisk Open Source=1.6.2.13
Asterisk Open Source=1.6.2.14
Asterisk Open Source=1.6.2.14-rc1
Asterisk Open Source=1.6.2.15
Asterisk Open Source=1.6.2.15-rc1
Asterisk Open Source=1.6.2.15.1
Asterisk Open Source=1.6.2.16
Asterisk Open Source=1.6.2.16-rc1
Asterisk Open Source=1.6.2.16.1
Asterisk Open Source=1.6.2.16.2
Asterisk Open Source=1.6.2.17
Asterisk Open Source=1.6.2.17-rc1
Asterisk Open Source=1.6.2.17-rc2
Asterisk Open Source=1.6.2.17-rc3
Asterisk Open Source=1.6.2.17.1
Asterisk Open Source=1.6.2.17.2
Asterisk Open Source=1.6.2.17.3
Asterisk Open Source=1.6.2.18
Asterisk Open Source=1.6.2.18-rc1
Asterisk Open Source=1.6.2.18.1
Asterisk Open Source=1.6.2.18.2
Asterisk Open Source=1.6.2.19
Asterisk Open Source=1.6.2.19-rc1
Asterisk Open Source=1.6.2.20
Asterisk Open Source=1.6.2.21
Asterisk Open Source=1.6.2.22
Asterisk Open Source=1.6.2.23
Asterisk Open Source=1.8.0
Asterisk Open Source=1.8.0-beta1
Asterisk Open Source=1.8.0-beta2
Asterisk Open Source=1.8.0-beta3
Asterisk Open Source=1.8.0-beta4
Asterisk Open Source=1.8.0-beta5
Asterisk Open Source=1.8.0-rc2
Asterisk Open Source=1.8.0-rc3
Asterisk Open Source=1.8.0-rc4
Asterisk Open Source=1.8.0-rc5
Asterisk Open Source=1.8.1
Asterisk Open Source=1.8.1-rc1
Asterisk Open Source=1.8.1.1
Asterisk Open Source=1.8.1.2
Asterisk Open Source=1.8.2
Asterisk Open Source=1.8.2-rc1
Asterisk Open Source=1.8.2.1
Asterisk Open Source=1.8.2.2
Asterisk Open Source=1.8.2.3
Asterisk Open Source=1.8.2.4
Asterisk Open Source=1.8.3
Asterisk Open Source=1.8.3-rc1
Asterisk Open Source=1.8.3-rc2
Asterisk Open Source=1.8.3-rc3
Asterisk Open Source=1.8.3.1
Asterisk Open Source=1.8.3.2
Asterisk Open Source=1.8.3.3
Asterisk Open Source=1.8.4
Asterisk Open Source=1.8.4-rc1
Asterisk Open Source=1.8.4-rc2
Asterisk Open Source=1.8.4-rc3
Asterisk Open Source=1.8.4.1
Asterisk Open Source=1.8.4.2
Asterisk Open Source=1.8.4.3
Asterisk Open Source=1.8.4.4
Asterisk Open Source=1.8.5-rc1
Asterisk Open Source=1.8.5.0
Asterisk Open Source=1.8.6.0
Asterisk Open Source=1.8.6.0-rc1
Asterisk Open Source=1.8.6.0-rc2
Asterisk Open Source=1.8.6.0-rc3
Asterisk Open Source=1.8.7.0
Asterisk Open Source=1.8.7.0-rc1
Asterisk Open Source=1.8.7.0-rc2
Asterisk Open Source=1.8.7.1
Asterisk Open Source=1.8.7.2
Asterisk Open Source=1.8.8.0
Asterisk Open Source=1.8.8.0-rc1
Asterisk Open Source=1.8.8.0-rc2
Asterisk Open Source=1.8.8.0-rc3
Asterisk Open Source=1.8.8.0-rc4
Asterisk Open Source=1.8.8.0-rc5
Asterisk Open Source=1.8.8.1
Asterisk Open Source=1.8.8.2
Asterisk Open Source=1.8.9.0
Asterisk Open Source=1.8.9.0-rc1
Asterisk Open Source=1.8.9.0-rc2
Asterisk Open Source=1.8.9.0-rc3
Asterisk Open Source=1.8.9.1
Asterisk Open Source=1.8.9.2
Asterisk Open Source=1.8.9.3
Asterisk Open Source=1.8.10.0
Asterisk Open Source=1.8.10.0-rc1
Asterisk Open Source=1.8.10.0-rc2
Asterisk Open Source=1.8.10.0-rc3
Asterisk Open Source=1.8.10.0-rc4
Asterisk Open Source=1.8.10.1
Asterisk Open Source=1.8.11.0-rc2
Asterisk Open Source=1.8.11.0-rc3
Asterisk Open Source=10.0.0
Asterisk Open Source=10.0.0-beta1
Asterisk Open Source=10.0.0-beta2
Asterisk Open Source=10.0.0-rc1
Asterisk Open Source=10.0.0-rc2
Asterisk Open Source=10.0.0-rc3
Asterisk Open Source=10.0.1
Asterisk Open Source=10.1.0
Asterisk Open Source=10.1.0-rc1
Asterisk Open Source=10.1.0-rc2
Asterisk Open Source=10.1.1
Asterisk Open Source=10.1.2
Asterisk Open Source=10.1.3
Asterisk Open Source=10.2.0
Asterisk Open Source=10.2.0-rc1
Asterisk Open Source=10.2.0-rc2
Asterisk Open Source=10.2.0-rc3
Asterisk Open Source=10.2.0-rc4
Asterisk Open Source=10.2.1
Asterisk Open Source=10.3.0
Asterisk Open Source=10.3.0-rc2
Asterisk Open Source=10.3.0-rc3
Remediation
Patch Available
Event History
Apr 30, 2012
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-2415?
CVE-2012-2415 has a severity rating that can lead to denial of service and potential remote code execution risk.
2
How do I fix CVE-2012-2415?
To fix CVE-2012-2415, upgrade Asterisk to versions 1.6.2.24, 1.8.11.1, or 10.3.1 and above.
3
Who is affected by CVE-2012-2415?
CVE-2012-2415 affects Asterisk versions 1.6.2.x below 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1.
4
What type of vulnerability is CVE-2012-2415?
CVE-2012-2415 is classified as a heap-based buffer overflow vulnerability.
5
Can CVE-2012-2415 be exploited remotely?
Yes, CVE-2012-2415 can be exploited by remote authenticated users.