Asterisk PJSIP Channel Driver Multiple DoS Vulnerabilities (AST-2014-005 / AST-2014-008)

Medium Nessus Plugin ID 76089


A telephony application running on the remote host is affected by multiple denial of service vulnerabilities.


According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by the following denial of service vulnerabilities in the PJSIP channel driver :

- A flaw exists in the publish / subscribe framework when an attempt to unsubscribe is made when not already subscribed. A remote attacker could exploit this flaw to cause a denial of service. (CVE-2014-4045)

- A flaw exists when handling a SIP transaction timeout which may cause SIP traffic to not be processed. This could allow a remote, authenticated attacker subscribe to a resource in Asterisk and immediately disconnect, resulting in a denial of service. (CVE-2014-4048)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.


Upgrade to Asterisk 12.3.1 or apply the appropriate patch listed in the Asterisk advisory.

See Also

Plugin Details

Severity: Medium

ID: 76089

File Name: asterisk_ast_2014_008.nasl

Version: $Revision: 1.7 $

Type: remote

Family: Misc.

Published: 2014/06/17

Modified: 2016/11/11

Dependencies: 63202

Risk Information

Risk Factor: Medium


Base Score: 5

Temporal Score: 4.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:digium:asterisk

Required KB Items: asterisk/sip_detected, Settings/ParanoidReport

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2014/06/12

Vulnerability Publication Date: 2014/06/12

Reference Information

CVE: CVE-2014-4045, CVE-2014-4048

BID: 68032, 68033

OSVDB: 108082, 108085