← Back

CVE-2009-2726

nvd nist
Published: Aug 12, 2009Modified: Apr 23, 2026

JSON object

Loading...
7.8
Vector
AV:N/AC:L/Au:N/C:N/I:N/A:C
Exploitability: 10.0 / Impact: 6.9
Source: NVD

Description

The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, 1.4.x before 1.4.26.1, 1.6.0.x before 1.6.0.12, and 1.6.1.x before 1.6.1.4; Asterisk Business Edition A.x.x, B.x.x before B.2.5.9, C.2.x before C.2.4.1, and C.3.x before C.3.1; and Asterisk Appliance s800i 1.2.x before 1.3.0.3 does not use a maximum width when invoking sscanf style functions, which allows remote attackers to cause a denial of service (stack memory consumption) via SIP packets containing large sequences of ASCII decimal characters, as demonstrated via vectors related to (1) the CSeq value in a SIP header, (2) large Content-Length value, and (3) SDP.

Affected (8)

Digium
2 products
Asterisk
S800i Firmware
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Digium
Asterisk
Before b.2.5.9
Asterisk
From c.2.0 to c.2.4.1
Asterisk
From c.3.0 to c.3.1
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
S800i Firmware
From 1.2.0 to 1.3.0.3
Running on/withPlatform Versions
Digium
S800i
All versions
Configuration C
4 vulnerable
Vulnerable SoftwareAffected Versions
Digium
Asterisk
From 1.2.0 to 1.2.34
Asterisk
From 1.4.0 to 1.4.26.1
Asterisk
From 1.6.0 to 1.6.0.12
Asterisk
From 1.6.1 to 1.6.1.4

Related CWEs

CWE-770
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

References (14)

Source: cve@mitre.org
Product
Source: cve@mitre.org
Broken Link
Source: cve@mitre.org
Broken LinkVendor Advisory
Source: cve@mitre.org
Broken LinkThird Party AdvisoryVDB Entry
Source: cve@mitre.org
Broken LinkExploitThird Party AdvisoryVDB Entry
Source: cve@mitre.org
Broken LinkThird Party AdvisoryVDB Entry
Source: cve@mitre.org
Broken LinkVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Product
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Broken LinkVendor Advisory

Timeline

No history available yet.