CVE-2014-2287: Input Validation

Published Apr 18, 2014

Updated

channels/chansip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chansip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value.

Affected Software

232 affected components

Asterisk=1.8.0.0

Asterisk=1.8.0.0-beta1

Asterisk=1.8.0.0-beta2

Asterisk=1.8.0.0-beta3

Asterisk=1.8.0.0-beta4

Asterisk=1.8.0.0-beta5

Asterisk=1.8.0.0-rc1

Asterisk=1.8.0.0-rc2

Asterisk=1.8.0.0-rc3

Asterisk=1.8.0.0-rc4

Asterisk=1.8.0.0-rc5

Asterisk=1.8.1.0

Asterisk=1.8.1.0-rc1

Asterisk=1.8.2.0

Asterisk=1.8.2.0-rc1

Asterisk=1.8.3.0

Asterisk=1.8.3.0-rc1

Asterisk=1.8.3.0-rc2

Asterisk=1.8.3.0-rc3

Asterisk=1.8.4.0

Asterisk=1.8.4.0-rc1

Asterisk=1.8.4.0-rc2

Asterisk=1.8.4.0-rc3

Asterisk=1.8.5.0

Asterisk=1.8.5.0-rc1

Asterisk=1.8.6.0

Asterisk=1.8.6.0-rc1

Asterisk=1.8.6.0-rc2

Asterisk=1.8.6.0-rc3

Asterisk=1.8.7.0

Asterisk=1.8.7.0-rc1

Asterisk=1.8.7.0-rc2

Asterisk=1.8.8.0

Asterisk=1.8.8.0-rc1

Asterisk=1.8.8.0-rc2

Asterisk=1.8.8.0-rc3

Asterisk=1.8.8.0-rc4

Asterisk=1.8.8.0-rc5

Asterisk=1.8.9.0

Asterisk=1.8.9.0-rc1

Asterisk=1.8.9.0-rc2

Asterisk=1.8.9.0-rc3

Asterisk=1.8.10.0

Asterisk=1.8.10.0-rc1

Asterisk=1.8.10.0-rc2

Asterisk=1.8.10.0-rc3

Asterisk=1.8.10.0-rc4

Asterisk=1.8.11.0

Asterisk=1.8.11.0-rc1

Asterisk=1.8.11.0-rc2

Asterisk=1.8.11.0-rc3

Asterisk=1.8.12.0

Asterisk=1.8.12.0-rc1

Asterisk=1.8.12.0-rc2

Asterisk=1.8.12.0-rc3

Asterisk=1.8.13.0

Asterisk=1.8.13.0-rc1

Asterisk=1.8.13.0-rc2

Asterisk=1.8.14.0-rc1

Asterisk=1.8.14.0-rc2

Asterisk=1.8.15

Asterisk=1.8.15-cert1

Asterisk=1.8.15-cert1_rc1

Asterisk=1.8.15-cert1_rc2

Asterisk=1.8.15-cert1_rc3

Asterisk=1.8.15-cert2

Asterisk=1.8.15-cert3

Asterisk=1.8.15-cert4

Asterisk=11.6-cert1

Asterisk=11.6-cert1_rc1

Asterisk=11.6-cert1_rc2

Asterisk=11.6.0

Asterisk=11.6.0-rc1

Asterisk=11.6.0-rc2

Asterisk=1.8.0

Asterisk=1.8.0-beta1

Asterisk=1.8.0-beta2

Asterisk=1.8.0-beta3

Asterisk=1.8.0-beta4

Asterisk=1.8.0-beta5

Asterisk=1.8.0-rc2

Asterisk=1.8.0-rc3

Asterisk=1.8.0-rc4

Asterisk=1.8.0-rc5

Asterisk=1.8.1

Asterisk=1.8.1-rc1

Asterisk=1.8.1.1

Asterisk=1.8.1.2

Asterisk=1.8.2

Asterisk=1.8.2.1

Asterisk=1.8.2.2

Asterisk=1.8.2.3

Asterisk=1.8.2.4

Asterisk=1.8.3

Asterisk=1.8.3-rc1

Asterisk=1.8.3-rc2

Asterisk=1.8.3-rc3

Asterisk=1.8.3.1

Asterisk=1.8.3.2

Asterisk=1.8.3.3

Asterisk=1.8.4

Asterisk=1.8.4-rc1

Asterisk=1.8.4-rc2

Asterisk=1.8.4-rc3

Asterisk=1.8.4.1

Asterisk=1.8.4.2

Asterisk=1.8.4.3

Asterisk=1.8.4.4

Asterisk=1.8.5

Asterisk=1.8.5-rc1

Asterisk=1.8.5.0

Asterisk=1.8.6.0

Asterisk=1.8.6.0-rc1

Asterisk=1.8.6.0-rc2

Asterisk=1.8.6.0-rc3

Asterisk=1.8.7.0

Asterisk=1.8.7.0-rc1

Asterisk=1.8.7.0-rc2

Asterisk=1.8.7.1

Asterisk=1.8.8.0

Asterisk=1.8.8.0-patch

Asterisk=1.8.8.0-rc1

Asterisk=1.8.8.0-rc2

Asterisk=1.8.8.0-rc3

Asterisk=1.8.8.0-rc4

Asterisk=1.8.8.0-rc5

Asterisk=1.8.8.1

Asterisk=1.8.8.2

Asterisk=1.8.9.0

Asterisk=1.8.9.0-rc1

Asterisk=1.8.9.0-rc2

Asterisk=1.8.9.0-rc3

Asterisk=1.8.9.1

Asterisk=1.8.9.2

Asterisk=1.8.9.3

Asterisk=1.8.10.0

Asterisk=1.8.10.0-rc1

Asterisk=1.8.10.0-rc2

Asterisk=1.8.10.0-rc3

Asterisk=1.8.10.0-rc4

Asterisk=1.8.10.1

Asterisk=1.8.11.0

Asterisk=1.8.11.0-patch

Asterisk=1.8.11.0-rc2

Asterisk=1.8.11.0-rc3

Asterisk=1.8.11.1

Asterisk=1.8.11.1-patch

Asterisk=1.8.12

Asterisk=1.8.12.0

Asterisk=1.8.12.0-rc1

Asterisk=1.8.12.0-rc2

Asterisk=1.8.12.0-rc3

Asterisk=1.8.12.1

Asterisk=1.8.12.2

Asterisk=1.8.13.0

Asterisk=1.8.13.0-rc1

Asterisk=1.8.13.0-rc2

Asterisk=1.8.13.1

Asterisk=1.8.14.0

Asterisk=1.8.14.0-patch

Asterisk=1.8.14.0-rc1

Asterisk=1.8.14.0-rc2

Asterisk=1.8.14.1

Asterisk=1.8.14.1-patch

Asterisk=1.8.15.0

Asterisk=1.8.15.0-rc1

Asterisk=1.8.15.1

Asterisk=1.8.16.0

Asterisk=1.8.16.0-rc1

Asterisk=1.8.16.0-rc2

Asterisk=1.8.17.0

Asterisk=1.8.17.0-patch

Asterisk=1.8.17.0-rc1

Asterisk=1.8.17.0-rc2

Asterisk=1.8.17.0-rc3

Asterisk=1.8.18.0

Asterisk=1.8.18.0-rc1

Asterisk=1.8.18.1

Asterisk=1.8.19.0

Asterisk=1.8.19.0-rc1

Asterisk=1.8.19.0-rc3

Asterisk=1.8.19.1

Asterisk=1.8.20.0

Asterisk=1.8.20.0-patch

Asterisk=1.8.20.0-rc1

Asterisk=1.8.20.0-rc2

Asterisk=1.8.20.1

Asterisk=1.8.20.1-patch

Asterisk=1.8.20.2

Asterisk=1.8.20.2-patch

Asterisk=1.8.21.0

Asterisk=1.8.21.0-rc1

Asterisk=1.8.21.0-rc2

Asterisk=1.8.22.0

Asterisk=1.8.22.0-rc1

Asterisk=1.8.22.0-rc2

Asterisk=1.8.23.0

Asterisk=1.8.23.0-patch

Asterisk=1.8.23.0-rc1

Asterisk=1.8.23.0-rc2

Asterisk=1.8.23.1

Asterisk=1.8.24.0

Asterisk=1.8.24.0-rc1

Asterisk=1.8.24.0-rc2

Asterisk=1.8.24.1

Asterisk=1.8.25.0

Asterisk=1.8.25.0-rc1

Asterisk=1.8.25.0-rc2

Asterisk=1.8.26.0

Asterisk=1.8.26.0-rc1

Asterisk=11.8.0

Asterisk=11.8.0-rc1

Asterisk=11.8.0-rc2

Asterisk=11.8.0-rc3

Asterisk=12.1.0

Asterisk=12.1.0-rc1

Asterisk=12.1.0-rc2

Asterisk=12.1.0-rc3

fedoraproject fedora=19

fedoraproject fedora=20

Event History

Apr 18, 2014

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Data Sourced

via NVD·10:14 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-2287?

CVE-2014-2287 has a medium severity rating as it allows remote authenticated users to cause a denial of service.

How do I fix CVE-2014-2287?

To fix CVE-2014-2287, upgrade Asterisk to the latest version where this vulnerability is patched, specifically versions 1.8.26.1, 11.8.1, 12.1.1, and corresponding certified Asterisk versions.

Who is affected by CVE-2014-2287?

CVE-2014-2287 affects Asterisk Open Source and Certified Asterisk versions earlier than the specified patched versions.

What type of vulnerability is CVE-2014-2287?

CVE-2014-2287 is classified as a denial of service vulnerability.

Can CVE-2014-2287 be exploited remotely?

Yes, CVE-2014-2287 can be exploited by remote authenticated users.