CVE-2014-8415: Input Validation
Race condition in the chanpjsip channel driver in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a cancel request for a SIP session with a queued action to (1) answer a session or (2) send ringing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8415?
CVE-2014-8415 has a medium severity rating as it allows remote attackers to cause a denial of service.
How do I fix CVE-2014-8415?
To fix CVE-2014-8415, update Asterisk to version 12.7.1 or later, or to version 13.0.1 or later.
What versions of Asterisk are affected by CVE-2014-8415?
Asterisk versions prior to 12.7.1 and 13.0.1 are affected by CVE-2014-8415.
What type of attack is possible with CVE-2014-8415?
CVE-2014-8415 allows for a denial of service attack due to a race condition in the SIP channel driver.
What is the impact of exploiting CVE-2014-8415?
Exploiting CVE-2014-8415 can lead to assertion failures and crashes of the Asterisk application.