NVD

Id
38629  
Name
CVE-2013-2686  
Description
main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which allows remote attackers to conduct stack-consumption attacks and cause a denial of service (daemon crash) via a crafted HTTP POST request. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-5976.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-18  
Published
2013-04-01  
Modified Date
2013-04-01  
Seq
2013-2686  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
198079 38629 CVE-2013-2686 http://downloads.asterisk.org/pub/security/AST-2013-002.html  View
198080 38629 CVE-2013-2686 http://telussecuritylabs.com/threats/show/TSL20130327-01  View
198081 38629 CVE-2013-2686 https://issues.asterisk.org/jira/browse/ASTERISK-20967  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
20518 JVNDB-2013-002093 複数の Asterisk 製品におけるサービス運用妨害 (デーモンクラッシュ) 状態にされる脆弱性 Asterisk Open Source、Certified Asterisk および Asterisk Digiumphones の HTTP サーバの main/http.c は、Content-Length の値を適切に制限しないため、スタック消費攻撃を実行され、サービス運用妨害 (デーモンクラッシュ) 状態にされる脆弱性が存在します。 CVE-2013-2686 62628 CVE-2013-2686 38629 5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-002093.html 2013-03-27 2013-04-02 View