CVE-2010-0441
Published: 4 February 2010
Asterisk Open Source 1.6.0.x before 1.6.0.22, 1.6.1.x before 1.6.1.14, and 1.6.2.x before 1.6.2.2, and Business Edition C.3 before C.3.3.2, allows remote attackers to cause a denial of service (daemon crash) via an SIP T.38 negotiation with an SDP FaxMaxDatagram field that is (1) missing, (2) modified to contain a negative number, or (3) modified to contain a large number.
Priority
Status
| Package | Release | Status |
|---|---|---|
|
asterisk Launchpad, Ubuntu, Debian |
dapper |
Ignored
(end of life)
|
| hardy |
Not vulnerable
|
|
| intrepid |
Ignored
(end of life, was needs-triage)
|
|
| jaunty |
Ignored
(end of life)
|
|
| karmic |
Ignored
(end of life)
|
|
| lucid |
Not vulnerable
(1:1.6.2.5-0ubuntu1.3)
|
|
| maverick |
Not vulnerable
(1:1.6.2.7-1ubuntu1.1)
|
|
| natty |
Not vulnerable
(1:1.6.2.9-2ubuntu2)
|
|
| upstream |
Released
(1.6.0.22,1.6.1.14,1.6.2.2)
|
|
|
Patches: upstream: http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.0.diff upstream: http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.1.diff upstream: http://downloads.asterisk.org/pub/security/AST-2010-001-1.6.2.diff |
||