CVE Feed

    Dashboard / CVE / CVE-2012-0885

    CVE-2012-0885

    chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SDP message with a crypto attribute and a (1) video or (2) text media type, as demonstrated by CSipSimple.

    Published:Jan 25, 2012
    Last Modified:Apr 11, 2025
    EPS:Jan 25, 2012
    EPSS Score:0.01057
    CVSS Score:4.3

    Affected Products

    Vendor
    Asterisk
    Product
    Open Source

    Exploits

    https://issues.asterisk.org/jira/secure/attachment/42202/issueA19202_crypto_if_uninited_text_or_video.patchhttps://issues.asterisk.org/jira/secure/attachment/42202/issueA19202_crypto_if_uninited_text_or_video.patch

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2013-2685 (CVSS 7.5) — Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows re…
    CVE-2013-2264 (CVSS 5) — The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.…
    CVE-2013-2686 (CVSS 5) — main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x be…
    CVE-2012-2186 (CVSS 9) — Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x be…
    CVE-2012-2948 (CVSS 4) — chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 an…
    CVE-2012-2416 (CVSS 6.5) — chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and …
    CVE-2012-2415 (CVSS 6.5) — Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x befor…
    CVE-2012-2414 (CVSS 6.5) — main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1…
    CVE-2011-4063 (CVSS 6.8) — chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 d…
    CVE-2009-2346 (CVSS 7.8) — The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x b…

    References

    http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff
    http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff
    http://downloads.asterisk.org/pub/security/AST-2012-001.html
    http://www.openwall.com/lists/oss-security/2012/01/20/16
    http://www.openwall.com/lists/oss-security/2012/01/20/18
    https://bugzilla.redhat.com/show_bug.cgi?id=783487
    https://issues.asterisk.org/jira/browse/ASTERISK-19202
    https://issues.asterisk.org/jira/secure/attachment/42202/issueA19202_crypto_if_uninited_text_or_video.patch
    http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff
    http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff
    http://downloads.asterisk.org/pub/security/AST-2012-001.html
    http://www.openwall.com/lists/oss-security/2012/01/20/16
    http://www.openwall.com/lists/oss-security/2012/01/20/18
    https://bugzilla.redhat.com/show_bug.cgi?id=783487
    https://issues.asterisk.org/jira/browse/ASTERISK-19202
    https://issues.asterisk.org/jira/secure/attachment/42202/issueA19202_crypto_if_uninited_text_or_video.patch

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High