CVE-2014-2286

High

Published: 18/04/2014(UTC)Translated: 17/06/2026(UTC)NVD NIST

Summary

In Asterisk Open Source versions 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, as well as Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, there is a vulnerability that allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.

Risk Assessment

This vulnerability may lead to significant disruptions in system operation and allow attackers to gain control over the system, posing a threat to the integrity and availability of services.

Recommendation

It is recommended to update Asterisk to the latest version to eliminate this vulnerability and to monitor logs for potential attack attempts.

Other vulnerabilities in Asterisk Open Source, Certified Asterisk

CVE-2016-7551High
In Asterisk Open Source versions 11.x before 11.23.1 and 13.x before 13.11.1, as well as Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3, there is a vulnerability in the chain_sip module that allows remote attackers to cause a denial of service (port exhaustion).

Original NVD description (English source)

main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.