CVE Feed

    Dashboard / CVE / CVE-2012-2415

    CVE-2012-2415

    Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a series of KEYPAD_BUTTON_MESSAGE events.

    Published:Apr 30, 2012
    Last Modified:Apr 11, 2025
    EPS:Apr 30, 2012
    EPSS Score:0.10525
    CVSS Score:6.5

    Affected Products

    Vendor
    Asterisk
    Product
    Open Source

    Exploits

    No exploit reference

    Related CVEs

    CVE-2013-2685 (CVSS 7.5) — Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows re…
    CVE-2013-2264 (CVSS 5) — The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.…
    CVE-2013-2686 (CVSS 5) — main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x be…
    CVE-2012-2186 (CVSS 9) — Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x be…
    CVE-2012-2948 (CVSS 4) — chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 an…
    CVE-2012-2416 (CVSS 6.5) — chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and …
    CVE-2012-2414 (CVSS 6.5) — main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1…
    CVE-2012-0885 (CVSS 4.3) — chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is us…
    CVE-2011-4063 (CVSS 6.8) — chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 d…
    CVE-2009-2346 (CVSS 7.8) — The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x b…

    References

    http://downloads.asterisk.org/pub/security/AST-2012-005.html
    http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079759.html
    http://osvdb.org/81455
    http://secunia.com/advisories/48891
    http://secunia.com/advisories/48941
    http://www.debian.org/security/2012/dsa-2460
    http://www.securityfocus.com/bid/53210
    http://www.securitytracker.com/id?1026962
    https://exchange.xforce.ibmcloud.com/vulnerabilities/75102
    http://downloads.asterisk.org/pub/security/AST-2012-005.html
    http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079759.html
    http://osvdb.org/81455
    http://secunia.com/advisories/48891
    http://secunia.com/advisories/48941
    http://www.debian.org/security/2012/dsa-2460
    http://www.securityfocus.com/bid/53210
    http://www.securitytracker.com/id?1026962
    https://exchange.xforce.ibmcloud.com/vulnerabilities/75102

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High