Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2009-0871

The SIP channel driver in Asterisk Open Source 1.4.22, 1.4.23, and 1.4.23.1; 1.6.0 before 1.6.0.6; 1.6.1 before 1.6.1.0-rc2; and Asterisk Business Edition C.2.3, with the pedantic option enabled, allows remote authenticated users to cause a denial of service (crash) via a SIP INVITE request without any headers, which triggers a NULL pointer dereference in the (1) sip_uri_headers_cmp and (2) sip_uri_params_cmp functions.

Published

2009-03-11T14:19:15.420

Last Modified

2025-04-09T00:30:58.490

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 3.5 (LOW)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: SINGLE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

6.8

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application digium asterisk 1.4.22 Yes
Application digium asterisk 1.4.23 Yes
Application digium asterisk 1.4.23.1 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0 Yes
Application digium asterisk 1.6.0.1 Yes
Application digium asterisk 1.6.0.2 Yes
Application digium asterisk 1.6.0.3 Yes
Application digium asterisk 1.6.0.3 Yes
Application digium asterisk 1.6.0.4 Yes
Application digium asterisk 1.6.0.5 Yes
Application digium asterisk 1.6.1 Yes
Application digium asterisk 1.6.1 Yes
Application digium asterisk 1.6.1 Yes
Application digium asterisk 1.6.1 Yes
Application digium asterisk 1.6.1 Yes
Application digium asterisk 1.6.1 Yes
Application digium asterisk c.2.3 Yes
References