chanskinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by closing a connection in off-hook mode.

A denial of service flaw was found in the way asterisk processed certain requests to negotiate secure video stream, when the ressrtp Asterisk module has been loaded and video support has not been enabled. A remote attacker could provide a specially-crafted media stream negotiation request, which once processed by Asterisk would lead to asterisk daemon crash by processing crypto line for such media stream.

References: [1] http://downloads.asterisk.org/pub/security/AST-2012-001.html [2] https://issues.asterisk.org/jira/browse/ASTERISK-19202

Upstream patch against the v1.8.x branch: [3] http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff

Upstream patch against the v1.10.x branch: [4] http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff