Vulnerabilities > CVE-2014-4045 - Numeric Errors vulnerability in Digium Asterisk
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
PARTIAL Summary
The Publish/Subscribe Framework in the PJSIP channel driver in Asterisk Open Source 12.x before 12.3.1, when sub_min_expiry is set to zero, allows remote attackers to cause a denial of service (assertion failure and crash) via an unsubscribe request when not subscribed to the device.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 13 |
Common Weakness Enumeration (CWE)
Nessus
| NASL family | Misc. |
| NASL id | ASTERISK_AST_2014_008.NASL |
| description | According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by the following denial of service vulnerabilities in the PJSIP channel driver : - A flaw exists in the publish / subscribe framework when an attempt to unsubscribe is made when not already subscribed. A remote attacker could exploit this flaw to cause a denial of service. (CVE-2014-4045) - A flaw exists when handling a SIP transaction timeout which may cause SIP traffic to not be processed. This could allow a remote, authenticated attacker subscribe to a resource in Asterisk and immediately disconnect, resulting in a denial of service. (CVE-2014-4048) Note that Nessus has not tested for these issues but has instead relied only on the application |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 76089 |
| published | 2014-06-17 |
| reporter | This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/76089 |
| title | Asterisk PJSIP Channel Driver Multiple DoS Vulnerabilities (AST-2014-005 / AST-2014-008) |