CVE-2014-2288: Input Validation

Published Apr 18, 2014

Updated

The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualifyfrequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request.

Affected Software

5 affected components

Asterisk=12.0.0

Asterisk=12.1.0

Asterisk=12.1.0-rc1

Asterisk=12.1.0-rc2

Asterisk=12.1.0-rc3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Asterisk Open Source PJSIP channel driver to a version that resolves this vulnerability.
Fixed in 12.1.1

Event History

Apr 18, 2014

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Data Sourced

via NVD·10:14 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-2288?

CVE-2014-2288 has a severity rating that classifies it as a denial of service vulnerability.

How do I fix CVE-2014-2288?

To fix CVE-2014-2288, upgrade to Asterisk version 12.1.1 or later.

What versions of Asterisk are affected by CVE-2014-2288?

Asterisk versions 12.0.0, 12.1.0, and all release candidates for 12.1.0 are affected by CVE-2014-2288.

What type of attack does CVE-2014-2288 allow?

CVE-2014-2288 allows remote attackers to cause a denial of service by triggering a crash in the Asterisk application.

Is CVE-2014-2288 exploitable over the internet?

Yes, CVE-2014-2288 is potentially exploitable over the internet if the Asterisk server is publicly accessible.