CVE-2011-2665 Null dereference in n/a

What is CVE-2011-2665?

CVE-2011-2665 is a medium-severity vulnerability in Digium Asterisk, published on 6 Jul 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a SIP packet with a Contact header that lacks a < (less than) character.

Which versions are affected by CVE-2011-2665?

It affects 1 product.

Products include Digium Asterisk.

How do I fix CVE-2011-2665?

Upgrade to a fixed version.

Is CVE-2011-2665 being exploited?

There is no known exploitation of CVE-2011-2665 in the wild and no public exploit code.

Other vulnerabilities in Digium Asterisk

• CVE-2017-14100 Command injection in n/a Critical 9.8
• CVE-2014-8418 Privilege escalation in n/a Critical 9.0
• CVE-2011-1599 Missing authorization in n/a Critical 9.0
• CVE-2017-16671 Memory corruption in n/a High 8.8
• CVE-2017-7617 Memory corruption in n/a High 8.8

All Digium Asterisk vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2011-2665, GHSA-88q7-cxrf-7jjm.