CVE-2013-2685: Buffer Overflow
Published Mar 29, 2013
·Updated
Stack-based buffer overflow in res/resformatattrh264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long sprop-parameter-sets H.264 media attribute in a SIP Session Description Protocol (SDP) header.
Affected Software
16 affected components
Asterisk Open Source=11.0.0
Asterisk Open Source=11.0.0-beta1
Asterisk Open Source=11.0.0-beta2
Asterisk Open Source=11.0.0-rc1
Asterisk Open Source=11.0.0-rc2
Asterisk Open Source=11.0.1
Asterisk Open Source=11.0.2
Asterisk Open Source=11.1.0
Asterisk Open Source=11.1.0-rc1
Asterisk Open Source=11.1.0-rc3
Asterisk Open Source=11.1.1
Asterisk Open Source=11.1.2
Asterisk Open Source=11.2.0
Asterisk Open Source=11.2.0-rc1
Asterisk Open Source=11.2.0-rc2
Asterisk Open Source=11.2.1
Event History
Mar 29, 2013
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-2685?
CVE-2013-2685 has been rated as a critical vulnerability due to its ability to allow remote attackers to execute arbitrary code.
2
How do I fix CVE-2013-2685?
To fix CVE-2013-2685, users should upgrade to Asterisk Open Source versions 11.2.2 or later.
3
What types of attacks can exploit CVE-2013-2685?
CVE-2013-2685 can be exploited through specially crafted SIP Session Description Protocol (SDP) headers.
4
In which Asterisk versions is CVE-2013-2685 present?
CVE-2013-2685 affects Asterisk Open Source versions from 11.0.0 to 11.2.1.
5
Is CVE-2013-2685 a stack-based or heap-based vulnerability?
CVE-2013-2685 is a stack-based buffer overflow vulnerability.