CVE-2014-8413

High

Published: 24/11/2014(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, allowing remote attackers to bypass intended PJSIP ACL rules.

Risk Assessment

Attackers may bypass security measures, leading to unauthorized access to the system and potential abuse.

Recommendation

It is recommended to update Asterisk to version 12.7.1 or 13.0.1 to address this vulnerability.

Other vulnerabilities in Asterisk Open Source

CVE-2016-9937High
An issue was discovered in Asterisk Open Source versions 13.12.x, 13.13.x before 13.13.1, and 14.x before 14.2.1 related to the handling of the Opus codec. Receiving an SDP offer or answer with format parameters separated by spaces causes the code to recursively call itself, leading to a crash.

Original NVD description (English source)

The res_pjsip_acl module in Asterisk Open Source 12.x before 12.7.1 and 13.x before 13.0.1 does not properly create and load ACLs defined in pjsip.conf at startup, which allows remote attackers to bypass intended PJSIP ACL rules.