Vulnerability CVE-2013-2685
Published: 2013-04-01

Description:
Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a long sprop-parameter-sets H.264 media attribute in a SIP Session Description Protocol (SDP) header.

Type:

CWE-119

 (Improper Restriction of Operations within the Bounds of a Memory Buffer)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
Asterisk -> Open source 

 References:
https://issues.asterisk.org/jira/browse/ASTERISK-20901
http://downloads.asterisk.org/pub/security/AST-2013-001.html
Copyright 2024, cxsecurity.com

 

Back to Top