FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2014-2286

This CVE name corresponds to:

Entered	Topic
2014-03-10	asterisk -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2014-2286 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2014-2286
Phase	Assigned(20140305)

Description

main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.

References

Source	Reference
MISC	http://downloads.asterisk.org/pub/security/AST-2014-001-1.8.diff
CONFIRM	http://downloads.asterisk.org/pub/security/AST-2014-001.html
CONFIRM	https://issues.asterisk.org/jira/browse/ASTERISK-23340
FEDORA	FEDORA-2014-3762
FEDORA	FEDORA-2014-3779
MANDRIVA	MDVSA-2014:078
BID	66093