Description
Unspecified vulnerability in the SIP channel driver (channels/chan_sip.c) in Asterisk 1.2.x before 1.2.13 and 1.4.x before 1.4.0-beta3 allows remote attackers to cause a denial of service (resource consumption) via unspecified vectors that result in the creation of "a real pvt structure" that uses more resources than necessary.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:1.2.13~dfsg-1 | — |
References
- ADV-2006-4098 vdb-entry
- http://ftp.digium.com/pub/asterisk/releases/ChangeLog-1.2.13
- GLSA-200610-15 vendor-advisory
- 20835 vdb-entry
- SUSE-SA:2006:069 vendor-advisory
- asterisk-channeldriver-dos(29664) vdb-entry
- 22651 third-party-advisory
- OpenPKG-SA-2006.024 vendor-advisory
- http://www.asterisk.org/node/110
- 22979 third-party-advisory
- http://www.asterisk.org/node/109
- 29973 vdb-entry