CVE-2012-5977

Asterisk < 1.8.19.0, 10.x < 10.11.1, 11.x < 11.1.2 - Denial of Service via Anonymous Call Device State Cache Flooding

Title source: llm
STIX 2.1

Description

Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a denial of service (resource consumption) by making anonymous calls from multiple sources and consequently adding many entries to the device state cache.

References (3)

Core 3
Core References
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2013/dsa-2605
Vendor Advisory x_refsource_confirm
https://issues.asterisk.org/jira/browse/ASTERISK-20175
Vendor Advisory x_refsource_confirm
http://downloads.asterisk.org/pub/security/AST-2012-015

Scores

EPSS 0.0211
EPSS Percentile 79.6%

Details

CWE
CWE-119
Status published
Products (24)
digium/asterisk 1.8.0 (10 CPE variants)
digium/asterisk 1.8.1 (2 CPE variants)
digium/asterisk 1.8.1.1
digium/asterisk 1.8.1.2
digium/asterisk 1.8.2
digium/asterisk 1.8.2.1
digium/asterisk 1.8.2.2
digium/asterisk 1.8.2.3
digium/asterisk 1.8.2.4
digium/asterisk 1.8.3 (4 CPE variants)
... and 14 more
Published Jan 04, 2013
Tracked Since Feb 18, 2026