CVE-2012-0885
Last modified
CVE-2012-0885 is a vulnerability of currently unknown severity. chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SDP message with a crypto attribute and a (1) video or (2) text media type, as demonstrated by CSipSimple.. EPSS estimates a 2.50% chance of exploitation in the next 30 days.
Description
chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SDP message with a crypto attribute and a (1) video or (2) text media type, as demonstrated by CSipSimple.
Metrics
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Asterisk | Open Source | 1.8.0 | — |
| Asterisk | Open Source | 1.8.1 | — |
| Asterisk | Open Source | 1.8.1.1 | — |
| Asterisk | Open Source | 1.8.1.2 | — |
| Asterisk | Open Source | 1.8.2 | — |
| Asterisk | Open Source | 1.8.2.1 | — |
| Asterisk | Open Source | 1.8.2.2 | — |
| Asterisk | Open Source | 1.8.2.3 | — |
| Asterisk | Open Source | 1.8.2.4 | — |
| Asterisk | Open Source | 1.8.3 | — |
| Asterisk | Open Source | 1.8.3.1 | — |
| Asterisk | Open Source | 1.8.3.2 | — |
| Asterisk | Open Source | 1.8.3.3 | — |
| Asterisk | Open Source | 1.8.4 | — |
| Asterisk | Open Source | 1.8.4.1 | — |
| Asterisk | Open Source | 1.8.4.2 | — |
| Asterisk | Open Source | 1.8.4.3 | — |
| Asterisk | Open Source | 1.8.4.4 | — |
| Asterisk | Open Source | 1.8.5 | Rc1 |
| Asterisk | Open Source | 1.8.5.0 | — |
| Asterisk | Open Source | 1.8.6.0 | — |
| Asterisk | Open Source | 1.8.7.0 | — |
| Asterisk | Open Source | 1.8.7.1 | — |
| Asterisk | Open Source | 1.8.7.2 | — |
| Asterisk | Open Source | 1.8.8.0 | — |
| Asterisk | Open Source | 1.8.8.1 | — |
| Asterisk | Open Source | 10.0.0 | — |
References
- http://downloads.asterisk.org/pub/security/AST-2012-001.htmlVendor Advisory
- http://downloads.asterisk.org/pub/security/AST-2012-001.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2012-0885?
How severe is CVE-2012-0885?
How do I fix CVE-2012-0885?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2012
- CVE-2012-0879The I/O implementation for block devices in the Linux kernel…5.5
- CVE-2012-0880Apache Xerces-C++ allows remote attackers to cause a denial …
- CVE-2012-0881Apache Xerces2 Java Parser before 2.12.0 allows remote attac…
- CVE-2012-0882Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possib…
- CVE-2012-0883envvars (aka envvars-std) in the Apache HTTP Server before 2…
- CVE-2012-0884The implementation of Cryptographic Message Syntax (CMS) and…
- CVE-2012-0891Multiple cross-site scripting (XSS) vulnerabilities in Puppe…
- CVE-2012-0895Cross-site scripting (XSS) vulnerability in map/map.php in t…
- CVE-2012-0896Absolute path traversal vulnerability in download.php in the…
- CVE-2012-0897Stack-based buffer overflow in the JPEG2000 plugin in IrfanV…
- CVE-2012-0898Directory traversal vulnerability in meb_download.php in the…
- CVE-2012-0899Cross-site scripting (XSS) vulnerability in referencement/si…
Are you affected by CVE-2012-0885?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST