CVE-2014-9374: Double Free

Published Dec 12, 2014

Updated

Double free vulnerability in the WebSocket Server (reshttpwebsocket module) in Asterisk Open Source 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 and Certified Asterisk 11.6 before 11.6-cert9 allows remote attackers to cause a denial of service (crash) by sending a zero length frame after a non-zero length frame.

Affected Software

80 affected components

Digium Asterisk Appliance Developer Kit=11.6-cert1

Digium Asterisk Appliance Developer Kit=11.6-cert2

Digium Asterisk Appliance Developer Kit=11.6-cert3

Digium Asterisk Appliance Developer Kit=11.6-cert4

Digium Asterisk Appliance Developer Kit=11.6-cert5

Digium Asterisk Appliance Developer Kit=11.6-cert6

Digium Asterisk Appliance Developer Kit=11.6-cert7

Digium Asterisk Appliance Developer Kit=11.6-cert8

Digium Asterisk Appliance Developer Kit=11.6.0

Asterisk=11.0.0

Asterisk=11.0.0-beta1

Asterisk=11.0.0-beta2

Asterisk=11.0.0-rc1

Asterisk=11.0.0-rc2

Asterisk=11.1.0

Asterisk=11.1.0-rc1

Asterisk=11.1.0-rc2

Asterisk=11.1.0-rc3

Asterisk=11.2.0

Asterisk=11.2.0-rc1

Asterisk=11.2.0-rc2

Asterisk=11.3.0-rc1

Asterisk=11.3.0-rc2

Asterisk=11.4.0

Asterisk=11.4.0-rc1

Asterisk=11.4.0-rc2

Asterisk=11.4.0-rc3

Asterisk=11.4.0-rc4

Asterisk=11.5.0

Asterisk=11.5.0-rc1

Asterisk=11.5.0-rc2

Asterisk=11.6.0

Asterisk=11.6.0-rc1

Asterisk=11.6.0-rc2

Asterisk=11.7.0

Asterisk=11.7.0-rc1

Asterisk=11.7.0-rc2

Asterisk=11.8.0

Asterisk=11.8.0-rc1

Asterisk=11.8.0-rc2

Asterisk=11.8.0-rc3

Asterisk=11.9.0

Asterisk=11.9.0-rc1

Asterisk=11.9.0-rc2

Asterisk=11.9.0-rc3

Asterisk=11.10.0

Asterisk=11.10.0-rc1

Asterisk=11.11.0

Asterisk=11.11.0-rc1

Asterisk=11.12.0

Asterisk=11.12.0-rc1

Asterisk=11.13.0

Asterisk=11.13.0-rc1

Asterisk=11.14.0

Asterisk=11.14.0-rc1

Asterisk=11.14.0-rc2

Asterisk=12.0.0

Asterisk=12.1.0

Asterisk=12.1.0-rc1

Asterisk=12.1.0-rc2

Asterisk=12.1.0-rc3

Asterisk=12.2.0

Asterisk=12.2.0-rc1

Asterisk=12.2.0-rc2

Asterisk=12.2.0-rc3

Asterisk=12.3.0

Asterisk=12.3.0-rc1

Asterisk=12.3.0-rc2

Asterisk=12.4.0

Asterisk=12.4.0-rc1

Asterisk=12.5.0

Asterisk=12.5.0-rc1

Asterisk=12.6.0

Asterisk=12.6.0-rc1

Asterisk=12.7.0

Asterisk=12.7.0-rc1

Asterisk=12.7.0-rc2

Asterisk=12.7.1

Asterisk=13.0.0

Asterisk=13.0.1

Remediation

Patch Available

http://downloads.asterisk.org/pub/security/AST-2014-019.html

Event History

Dec 12, 2014

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-9374?

CVE-2014-9374 has a high severity as it can lead to denial of service attacks through a double free vulnerability.

How do I fix CVE-2014-9374?

To fix CVE-2014-9374, update Asterisk to versions 11.14.2, 12.7.2, 13.0.2, or later.

Which versions of Asterisk are affected by CVE-2014-9374?

Asterisk versions 11.x before 11.14.2, 12.x before 12.7.2, and 13.x before 13.0.2 are affected by CVE-2014-9374.

What causes the vulnerability CVE-2014-9374?

CVE-2014-9374 is caused by a double free vulnerability in the WebSocket Server module of Asterisk.

Can CVE-2014-9374 be exploited remotely?

Yes, attackers can exploit CVE-2014-9374 remotely by sending a zero-length frame to the WebSocket Server.