NetSight
IP …
medium6.0

CVE-2011-0495

Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1,…

Impact

Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan function.

Affected products

VendorProductAffected versions
DigiumAsterisk
before c.3.6.2
from 1.2.0 through 1.2.40
from 1.4.0 before 1.4.38.1
from 1.4.39 before 1.4.39.1
from 1.6.1 before 1.6.1.21
from 1.6.2 before 1.6.2.15.1
DigiumAsterisknow
Version 1.5
FedoraprojectFedora
Versions 13, 14
DebianDebian Linux
Version 6.0
DigiumS800i Firmware
Version 1.2.0

Weakness classification

CWE-787

References