CVE-2011-1175 Null dereference in n/a
Remote attackers can crash the Asterisk PBX daemon by establishing many short TCP sessions to TLS services, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-1175?
CVE-2011-1175 is a medium-severity vulnerability in Digium Asterisk, published on 31 Mar 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.
Which versions are affected by CVE-2011-1175?
It affects 1 product.
Products include Digium Asterisk.
How do I fix CVE-2011-1175?
Upgrade to a fixed version.
Is CVE-2011-1175 being exploited?
There is no known exploitation of CVE-2011-1175 in the wild and no public exploit code.
Other vulnerabilities in Digium Asterisk
Sources
Also known as DEBIAN-CVE-2011-1175, GHSA-cfj4-pwcj-qhgc.