1. Home
  2. CVE Database
  3. CVE-2012-3863
MEDIUM · 4.0

CVE-2012-3863

channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Aster...

Vulnerability Description

channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a provisional response to a SIP reINVITE request, which allows remote authenticated users to cause a denial of service (RTP port exhaustion) via sessions that lack final responses.

CVSS Score

4.0

MEDIUM

AV:N/AC:L/Au:S/C:N/I:N/A:P
Confidentiality
NONE
Integrity
NONE
Availability
PARTIAL

Affected Products

VendorProductVersions
DigiumAsterisk Business Editionc.3.1
DigiumAsterisk1.8.0
DigiumAsteriske1.8.8.0
DigiumCertified Asterisk1.8.11

Related Weaknesses (CWE)

CWE-399

References

FAQ

What is CVE-2012-3863?

CVE-2012-3863 is a vulnerability with a CVSS score of 4.0 (MEDIUM). channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Aster...

How severe is CVE-2012-3863?

CVE-2012-3863 has been rated MEDIUM with a CVSS base score of 4.0/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2012-3863?

Check the references section above for vendor advisories and patch information. Affected products include: Digium Asterisk Business Edition, Digium Asterisk, Digium Asteriske, Digium Certified Asterisk.