CVE-2014-2289

Asterisk 12.x < 12.1.0 - Authenticated Denial of Service via PJSIP SUBSCRIBE Request

Title source: llm
STIX 2.1

Description

res/res_pjsip_exten_state.c in the PJSIP channel driver in Asterisk Open Source 12.x before 12.1.0 allows remote authenticated users to cause a denial of service (crash) via a SUBSCRIBE request without any Accept headers, which triggers an invalid pointer dereference.

References (5)

Core 5
Core References
Various Sources x_refsource_confirm
https://issues.asterisk.org/jira/browse/ASTERISK-23139
Patch, Vendor Advisory x_refsource_confirm
http://downloads.asterisk.org/pub/security/AST-2014-004.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html

Scores

EPSS 0.0218
EPSS Percentile 80.2%

Details

CWE
CWE-20
Status published
Products (2)
digium/asterisk 12.0.0
digium/asterisk 12.1.0 rc1 (3 CPE variants)
Published Apr 18, 2014
Tracked Since Feb 18, 2026