CVE-2015-1558: Low severity asterisk vulnerability

Published Feb 9, 2015

Updated

Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs.

Affected Software

34 affected components

Asterisk=12.0.0

Asterisk=12.1.0

Asterisk=12.1.0-rc1

Asterisk=12.1.0-rc2

Asterisk=12.1.0-rc3

Asterisk=12.1.1

Asterisk=12.2.0

Asterisk=12.2.0-rc1

Asterisk=12.2.0-rc2

Asterisk=12.2.0-rc3

Asterisk=12.3.0

Asterisk=12.3.0-rc1

Asterisk=12.3.0-rc2

Asterisk=12.3.1

Asterisk=12.3.2

Asterisk=12.4.0

Asterisk=12.4.0-rc1

Asterisk=12.5.0

Asterisk=12.5.0-rc1

Asterisk=12.6.0

Asterisk=12.6.0-rc1

Asterisk=12.7.0

Asterisk=12.7.0-rc1

Asterisk=12.7.0-rc2

Asterisk=12.8.0

Asterisk=12.8.0-rc1

Asterisk=12.8.0-rc2

Asterisk=12.8.1

Asterisk=13.0.0

Asterisk=13.1.0

Asterisk=13.1.0-rc1

Asterisk=13.1.0-rc2

Asterisk=13.2.0

Asterisk=13.2.0-rc1

Event History

Feb 9, 2015

CVE Published

via MITRE·11:00 AM

Data Sourced

via MITRE·11:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2015-1558?

CVE-2015-1558 has a severity rating that indicates a potential denial of service risk affecting Asterisk installations.

How do I fix CVE-2015-1558?

To fix CVE-2015-1558, upgrade Asterisk to version 12.8.1 or 13.1.1 or later.

What is the impact of CVE-2015-1558?

The impact of CVE-2015-1558 is file descriptor consumption leading to a denial of service for remote authenticated users.

Which versions of Asterisk are affected by CVE-2015-1558?

CVE-2015-1558 affects Asterisk versions 12.x before 12.8.1 and 13.x before 13.1.1.

Is remote authentication required to exploit CVE-2015-1558?

Yes, CVE-2015-1558 can only be exploited by remote authenticated users.