Buffer overflow in Digium Asterisk
CVE-2012-1184
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v2 metric
CVSS v2 base score 7.5 (High). Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.164 (96.9th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 96.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.164 · newest: 0.164 · change: 0.000
Affected products
- Digium Asterisk — versions 1.8.0, 1.8.1.1, 1.8.1.2
Weakness classification (CWE)
References
- www.openwall.com/lists/oss-security/2012/03/16/17 (mailing-list)
- downloads.asterisk.org/pub/security/AST-2012-003.pdf (Vendor Advisory)
- www.asterisk.org/node/51797 (Vendor Advisory)
- secunia.com/advisories/48417 (Vendor Advisory, third-party-advisory)
- www.openwall.com/lists/oss-security/2012/03/16/10 (mailing-list)
- downloads.asterisk.org/pub/security/AST-2012-003-1.8.diff
- osvdb.org/80126 (vdb-entry)
- www.securitytracker.com/id (vdb-entry)
- exchange.xforce.ibmcloud.com/vulnerabilities/74083 (vdb-entry)