What is CVE-2012-5976?

CVE-2012-5976 is a vulnerability in Digium Asterisk, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2013-01-04.

Is CVE-2012-5976 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Digium Asterisk

CVE-2012-5976

Multiple stack consumption vulnerabilities in Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones allow remote attackers to cause a denial of service (daemon crash) via TCP data using the (1) SIP, (2) HTTP, or (3) XMPP protocol.

Vulnerability class: Buffer Overflow

EPSS: 0.030 (86.1th percentile) — read the EPSS interpretation.

Affected products

Digium Asterisk — versions 1.8.0, 1.8.1, 1.8.1.1
Digium Certified_asterisk — versions 1.8.11
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

References

cve@mitre.org (x_refsource_CONFIRM, Vendor Advisory)
cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)

Frequently asked questions

What is CVE-2012-5976?: CVE-2012-5976 is a vulnerability in Digium Asterisk, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2013-01-04.
Is CVE-2012-5976 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.