CVE-2014-2289: Input Validation
Published Apr 18, 2014
·Updated
res/respjsipextenstate.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.
Affected Software
4 affected components
Asterisk=12.0.0
Asterisk=12.1.0-rc1
Asterisk=12.1.0-rc2
Asterisk=12.1.0-rc3
Remediation
Patch Available
Event History
Apr 18, 2014
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Data Sourced
via NVD·10:14 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-2289?
CVE-2014-2289 is classified as a denial of service vulnerability that can crash the Asterisk application.
2
How do I fix CVE-2014-2289?
To fix CVE-2014-2289, upgrade Asterisk to version 12.1.0 or later.
3
What versions of Asterisk are affected by CVE-2014-2289?
Asterisk versions 12.0.0 through 12.1.0-rc3 are affected by CVE-2014-2289.
4
What causes the vulnerability CVE-2014-2289?
CVE-2014-2289 is caused by an invalid pointer dereference triggered by a SUBSCRIBE request lacking Accept headers.
5
Who can exploit CVE-2014-2289?
Remote authenticated users can exploit CVE-2014-2289 to cause a denial of service.