Stack-based buffer overflow in Asterisk Open Source - CVE-2012-1184

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the ast_parse_digest function in main/utils.c when processing a long string in an HTTP Digest Authentication header. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

How to mitigate CVE-2012-1184

Links to Public Exploits and PoC-codes

• Exploit #3662 - Asterisk - 'ast_parse_digest()' Stack Buffer Overflow (July 29, 2020)

External References

• http://downloads.asterisk.org/pub/security/AST-2012-003.pdf
• http://downloads.asterisk.org/pub/security/AST-2012-003-1.8.diff
• http://osvdb.org/80126
• http://secunia.com/advisories/48417
• http://www.asterisk.org/node/51797
• http://www.openwall.com/lists/oss-security/2012/03/16/10
• http://www.openwall.com/lists/oss-security/2012/03/16/17
• http://www.securitytracker.com/id?1026813
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74083

Related Security Bulletins

• Stack-based buffer overflow in Asterisk
• Stack-based buffer overflow in asterisk (Alpine package)
• Gentoo update for Asterisk
• Fedora EPEL 6 update for asterisk
• Fedora EPEL 6 update for asterisk