This script is Copyright (C) 2013-2016 Tenable Network Security, Inc.
The remote Mandriva Linux host is missing one or more security
Multiple vulnerablilities was identified and fixed in asterisk :
The SIP channel driver in Asterisk Open Source 1.8.x before 184.108.40.206,
10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15
before 1.8.15-cert2; Asterisk Business Edition (BE) C.3.x before
C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before
10.12.2-digiumphones exhibits different behavior for invalid INVITE,
SUBSCRIBE, and REGISTER transactions depending on whether the user
account exists, which allows remote attackers to enumerate account
names by (1) reading HTTP status codes, (2) reading additional text in
a 403 (aka Forbidden) response, or (3) observing whether certain
retransmissions occur (CVE-2013-2264).
Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk
Open Source 11.x before 11.2.2 allows remote attackers to execute
arbitrary code via a long sprop-parameter-sets H.264 media attribute
in a SIP Session Description Protocol (SDP) header (CVE-2013-2685).
main/http.c in the HTTP server in Asterisk Open Source 1.8.x before
220.127.116.11, 10.x before 10.12.2, and 11.x before 11.2.2; Certified
Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones
10.x-digiumphones before 10.12.2-digiumphones does not properly
restrict Content-Length values, which allows remote attackers to
conduct stack-consumption attacks and cause a denial of service
(daemon crash) via a crafted HTTP POST request. NOTE: this
vulnerability exists because of an incorrect fix for CVE-2012-5976
The updated packages have upgraded to the 11.2.2 version which is not
vulnerable to these issues
Update the affected packages.
Risk factor :
High / CVSS Base Score : 7.5
CVSS Temporal Score : 6.5
Public Exploit Available : false