Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan function.

Matthew Nicholson discovered a buffer overflow in the SIP channel driver of Asterisk, an open source PBX and telephony toolkit, which could lead to the execution of arbitrary code.

Update to 1.6.2.16.1 to fix CVE-2011-0495.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 1.6.2.16.1 to fix CVE-2011-0495

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Using a specially crafted caller ID string, an authenticated user placing an outgoing call through the remote Asterisk server can cause a buffer overflow leading to an application crash or execution of arbitrary code.

Successful exploitation may require that the SIP channel driver is configured with the 'pedantic' option enabled.

ID	Name	Product	Family	Severity
52055	Debian DSA-2171-1 : asterisk - buffer overflow	Nessus	Debian Local Security Checks	medium
51864	Fedora 13 : asterisk-1.6.2.16.1-1.fc13 (2011-0794)	Nessus	Fedora Local Security Checks	medium
51863	Fedora 14 : asterisk-1.6.2.16.1-1.fc14 (2011-0774)	Nessus	Fedora Local Security Checks	medium
51644	Asterisk main/utils.c ast_uri_encode() CallerID Information Overflow (AST-2011-001)	Nessus	Gain a shell remotely	medium

Detections

Analytics

CVE-2011-0495

high

Tenable Plugins

medium

medium

medium

medium