Description
Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | asterisk | 1:1.6.2.9-2+squeeze1 | — |
| Debian 6.0 | asterisk | 1:1.6.2.9-2+squeeze1 | DSA-2171-1 |
| Debian 5.0 | asterisk | 1:1.4.21.2~dfsg-3+lenny2 | DSA-2171-1 |
Advisories 1
- DSA-2171-1 asterisk - buffer overflow Debian Security (DSA / DLA) · Mar 9, 2026
References
- ADV-2011-0159 vdb-entry
- FEDORA-2011-0794 vendor-advisory
- http://downloads.asterisk.org/pub/security/AST-2011-001.html
- 43373 third-party-advisory
- ADV-2011-0449 vdb-entry
- 70518 vdb-entry
- 45839 vdb-entry
- ADV-2011-0281 vdb-entry
- FEDORA-2011-0774 vendor-advisory
- DSA-2171 vendor-advisory
- 43119 third-party-advisory
- asterisk-asturiencode-bo(64831) vdb-entry
- http://downloads.asterisk.org/pub/security/AST-2011-001-1.6.2.diff
- 20110118 AST-2011-001: Stack buffer overflow in SIP channel driver mailing-list
- 42935 third-party-advisory