CVE-2012-5977: Buffer Overflow
Published Jan 4, 2013
·Updated
Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a denial of service (resource consumption) by making anonymous calls from multiple sources and consequently adding many entries to the device state cache.
Affected Software
202 affected components
Asterisk<=1.8.19.0
Asterisk=1.8.0
Asterisk=1.8.0-beta1
Asterisk=1.8.0-beta2
Asterisk=1.8.0-beta3
Asterisk=1.8.0-beta4
Asterisk=1.8.0-beta5
Asterisk=1.8.0-rc2
Asterisk=1.8.0-rc3
Asterisk=1.8.0-rc4
Asterisk=1.8.0-rc5
Asterisk=1.8.1
Asterisk=1.8.1-rc1
Asterisk=1.8.1.1
Asterisk=1.8.1.2
Asterisk=1.8.2
Asterisk=1.8.2.1
Asterisk=1.8.2.2
Asterisk=1.8.2.3
Asterisk=1.8.2.4
Asterisk=1.8.3
Asterisk=1.8.3-rc1
Asterisk=1.8.3-rc2
Asterisk=1.8.3-rc3
Asterisk=1.8.3.1
Asterisk=1.8.3.2
Asterisk=1.8.3.3
Asterisk=1.8.4
Asterisk=1.8.4-rc1
Asterisk=1.8.4-rc2
Asterisk=1.8.4-rc3
Asterisk=1.8.4.1
Asterisk=1.8.4.2
Asterisk=1.8.4.3
Asterisk=1.8.4.4
Asterisk=1.8.5
Asterisk=1.8.5-rc1
Asterisk=1.8.5.0
Asterisk=1.8.6.0
Asterisk=1.8.6.0-rc1
Asterisk=1.8.6.0-rc2
Asterisk=1.8.6.0-rc3
Asterisk=1.8.7.0
Asterisk=1.8.7.0-rc1
Asterisk=1.8.7.0-rc2
Asterisk=1.8.7.1
Asterisk=1.8.8.0
Asterisk=1.8.8.0-rc1
Asterisk=1.8.8.0-rc2
Asterisk=1.8.8.0-rc3
Asterisk=1.8.8.0-rc4
Asterisk=1.8.8.0-rc5
Asterisk=1.8.8.1
Asterisk=1.8.8.2
Asterisk=1.8.9.0
Asterisk=1.8.9.0-rc1
Asterisk=1.8.9.0-rc2
Asterisk=1.8.9.0-rc3
Asterisk=1.8.9.1
Asterisk=1.8.9.2
Asterisk=1.8.9.3
Asterisk=1.8.10.0
Asterisk=1.8.10.0-rc1
Asterisk=1.8.10.0-rc2
Asterisk=1.8.10.0-rc3
Asterisk=1.8.10.0-rc4
Asterisk=1.8.10.1
Asterisk=1.8.11.0
Asterisk=1.8.11.0-rc2
Asterisk=1.8.11.0-rc3
Asterisk=1.8.11.1
Asterisk=1.8.12
Asterisk=1.8.12.0
Asterisk=1.8.12.0-rc1
Asterisk=1.8.12.0-rc2
Asterisk=1.8.12.0-rc3
Asterisk=1.8.13.0
Asterisk=1.8.13.0-rc1
Asterisk=1.8.13.0-rc2
Asterisk=1.8.13.1
Asterisk=1.8.14.0-rc1
Asterisk=1.8.14.0-rc2
Asterisk=1.8.14.1
Asterisk=1.8.15.0
Asterisk=1.8.15.0-rc1
Asterisk=1.8.15.1
Asterisk=1.8.16.0
Asterisk=1.8.16.0-rc1
Asterisk=1.8.16.0-rc2
Asterisk=1.8.17.0
Asterisk=1.8.17.0-rc1
Asterisk=1.8.17.0-rc2
Asterisk=1.8.17.0-rc3
Asterisk=1.8.18.0
Asterisk=1.8.18.0-rc1
Asterisk=1.8.18.1
Asterisk=1.8.19.0-rc1
Asterisk=1.8.19.0-rc3
Asterisk=10.0.0
Asterisk=10.0.0-beta1
Asterisk=10.0.0-beta2
Asterisk=10.0.0-rc1
Asterisk=10.0.0-rc2
Asterisk=10.0.0-rc3
Asterisk=10.0.1
Asterisk=10.1.0
Asterisk=10.1.0-rc1
Asterisk=10.1.0-rc2
Asterisk=10.1.1
Asterisk=10.1.2
Asterisk=10.1.3
Asterisk=10.2.0
Asterisk=10.2.0-rc1
Asterisk=10.2.0-rc2
Asterisk=10.2.0-rc3
Asterisk=10.2.0-rc4
Asterisk=10.2.1
Asterisk=10.3.0
Asterisk=10.3.0-rc2
Asterisk=10.3.0-rc3
Asterisk=10.3.1
Asterisk=10.4.0
Asterisk=10.4.0-rc1
Asterisk=10.4.0-rc2
Asterisk=10.4.0-rc3
Asterisk=10.4.1
Asterisk=10.4.2
Asterisk=10.5.0
Asterisk=10.5.0-rc1
Asterisk=10.5.0-rc2
Asterisk=10.5.1
Asterisk=10.5.2
Asterisk=10.6.0
Asterisk=10.6.0
Asterisk=10.6.0-rc1
Asterisk=10.6.0-rc2
Asterisk=10.6.1
Asterisk=10.6.1
Asterisk=10.7.0
Asterisk=10.7.0
Asterisk=10.7.0-rc1
Asterisk=10.7.1
Asterisk=10.8.0
Asterisk=10.8.0-rc1
Asterisk=10.8.0-rc2
Asterisk=10.9.0
Asterisk=10.9.0-rc1
Asterisk=10.9.0-rc2
Asterisk=10.9.0-rc3
Asterisk=10.10.0
Asterisk=10.10.0-rc1
Asterisk=10.10.0-rc2
Asterisk=10.10.1
Asterisk=10.11.0
Asterisk=10.11.0-rc1
Asterisk=10.11.0-rc3
Asterisk=11.0.0
Asterisk=11.0.0-beta1
Asterisk=11.0.0-beta2
Asterisk=11.0.0-rc1
Asterisk=11.0.0-rc2
Asterisk=11.0.1
Asterisk=11.0.2
Asterisk=11.1.0
Asterisk=11.1.0-rc1
Asterisk=11.1.0-rc3
Asterisk=11.1.1
Digium Asterisk Appliance Developer Kit=1.8.11-cert
Digium Asterisk Appliance Developer Kit=1.8.11-cert1
Digium Asterisk Appliance Developer Kit=1.8.11-cert2
Digium Asterisk Appliance Developer Kit=1.8.11-cert3
Digium Asterisk Appliance Developer Kit=1.8.11-cert4
Digium Asterisk Appliance Developer Kit=1.8.11-cert5
Digium Asterisk Appliance Developer Kit=1.8.11-cert6
Digium Asterisk Appliance Developer Kit=1.8.11-cert7
Digium Asterisk Appliance Developer Kit=1.8.11-cert8
Digium Asterisk Appliance Developer Kit=1.8.11-cert9
Asterisk=10.0.0
Asterisk=10.0.0-beta1
Asterisk=10.0.0-beta2
Asterisk=10.0.0-rc1
Asterisk=10.0.0-rc2
Asterisk=10.0.0-rc3
Asterisk=10.1.0
Asterisk=10.1.0-rc1
Asterisk=10.1.0-rc2
Asterisk=10.1.1
Asterisk=10.2.0
Asterisk=10.2.0-rc1
Asterisk=10.2.0-rc2
Asterisk=10.2.0-rc3
Asterisk=10.2.0-rc4
Asterisk=10.3.0
Asterisk=10.3.0-rc2
Asterisk=10.3.0-rc3
Asterisk=10.4.0
Asterisk=10.4.0-rc1
Asterisk=10.4.0-rc2
Asterisk=10.5.0
Asterisk=10.5.0-rc1
Asterisk=10.5.0-rc2
Asterisk=10.5.1
Event History
Jan 4, 2013
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2012-5977?
The severity of CVE-2012-5977 is considered to be high due to its potential to cause denial of service.
2
How do I fix CVE-2012-5977?
To fix CVE-2012-5977, upgrade to Asterisk versions 1.8.19.1, 10.11.1, or 11.1.2 and above.
3
What types of systems are affected by CVE-2012-5977?
CVE-2012-5977 affects Asterisk versions prior to specific updates, including versions 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2.
4
What kind of exploit does CVE-2012-5977 allow?
CVE-2012-5977 allows remote attackers to cause a denial of service by exploiting anonymous call functionality.
5
Is there any workaround available for CVE-2012-5977?
Disabling anonymous calls can serve as a temporary workaround for CVE-2012-5977 until the system is upgraded.