CVE-2014-6610: Medium severity digium asterisk appliance developer kit vulnerability
Published Nov 26, 2014
·Updated
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the resfaxspandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application.
Affected Software
63 affected components
Digium Asterisk Appliance Developer Kit=11.6-cert1
Digium Asterisk Appliance Developer Kit=11.6-cert2
Digium Asterisk Appliance Developer Kit=11.6-cert3
Digium Asterisk Appliance Developer Kit=11.6-cert4
Digium Asterisk Appliance Developer Kit=11.6-cert5
Digium Asterisk Appliance Developer Kit=11.6.0
Asterisk=11.0.0
Asterisk=11.0.0-beta1
Asterisk=11.0.0-beta2
Asterisk=11.0.0-rc1
Asterisk=11.0.0-rc2
Asterisk=11.1.0
Asterisk=11.1.0-rc1
Asterisk=11.1.0-rc2
Asterisk=11.1.0-rc3
Asterisk=11.2.0
Asterisk=11.2.0-rc1
Asterisk=11.2.0-rc2
Asterisk=11.3.0-rc1
Asterisk=11.3.0-rc2
Asterisk=11.4.0
Asterisk=11.4.0-rc1
Asterisk=11.4.0-rc2
Asterisk=11.4.0-rc3
Asterisk=11.4.0-rc4
Asterisk=11.5.0
Asterisk=11.5.0-rc1
Asterisk=11.5.0-rc2
Asterisk=11.6.0
Asterisk=11.6.0-rc1
Asterisk=11.6.0-rc2
Asterisk=11.7.0
Asterisk=11.7.0-rc1
Asterisk=11.7.0-rc2
Asterisk=11.8.0
Asterisk=11.8.0-rc1
Asterisk=11.8.0-rc2
Asterisk=11.8.0-rc3
Asterisk=11.9.0
Asterisk=11.9.0-rc1
Asterisk=11.9.0-rc2
Asterisk=11.9.0-rc3
Asterisk=11.10.0
Asterisk=11.10.0-rc1
Asterisk=11.11.0
Asterisk=11.11.0-rc1
Asterisk=11.12.0
Asterisk=12.0.0
Asterisk=12.1.0
Asterisk=12.1.0-rc1
Asterisk=12.1.0-rc2
Asterisk=12.1.0-rc3
Asterisk=12.2.0
Asterisk=12.2.0-rc1
Asterisk=12.2.0-rc2
Asterisk=12.2.0-rc3
Asterisk=12.3.0
Asterisk=12.3.0-rc1
Asterisk=12.3.0-rc2
Asterisk=12.4.0
Asterisk=12.4.0-rc1
Asterisk=12.5.0
Asterisk=12.5.0-rc1
Remediation
Patch Available
Event History
Nov 26, 2014
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-6610?
CVE-2014-6610 is categorized as a denial of service vulnerability.
2
How do I fix CVE-2014-6610?
To fix CVE-2014-6610, update Asterisk to version 11.12.1, 12.5.1, or later.
3
Who is affected by CVE-2014-6610?
CVE-2014-6610 affects users of Asterisk versions prior to 11.12.1 and 12.5.1.
4
What is the impact of CVE-2014-6610?
The impact of CVE-2014-6610 is that it can lead to a crash in the application due to improper handling of messages.
5
When was CVE-2014-6610 reported?
CVE-2014-6610 was reported in 2014.