CVE-2012-1184

Digium Asterisk - Memory Corruption

Title source: rule
STIX 2.1

Description

Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header.

Exploits (1)

exploitdb WORKING POC
by Russell Bryant · textdoslinux
https://www.exploit-db.com/exploits/18855

References (9)

Core 9
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/03/16/17
Vendor Advisory x_refsource_confirm
http://www.asterisk.org/node/51797
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/48417
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/03/16/10
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/80126
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1026813
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/74083

Scores

EPSS 0.4170
EPSS Percentile 97.4%

Details

CWE
CWE-119
Status published
Products (24)
digium/asterisk 1.8.0 (10 CPE variants)
digium/asterisk 1.8.1.1
digium/asterisk 1.8.1.2
digium/asterisk 1.8.2
digium/asterisk 1.8.2.1
digium/asterisk 1.8.2.2
digium/asterisk 1.8.2.3
digium/asterisk 1.8.2.4
digium/asterisk 1.8.3 (4 CPE variants)
digium/asterisk 1.8.3.1
... and 14 more
Published Sep 18, 2012
Tracked Since Feb 18, 2026