Vulnerability Name:

CVE-2012-1183 (CCN-74082)

Assigned:2012-03-15
Published:2012-03-15
Updated:2020-08-25
Summary:Stack-based buffer overflow in the milliwatt_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6.2.23, 1.8.x before 1.8.10.1, and 10.x before 10.2.1, when the o option is used and the internal_timing option is off, allows remote attackers to cause a denial of service (application crash) via a large number of samples in an audio packet.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-119
Vulnerability Consequences:Denial of Service
References:Source: BUGTRAQ
Type: Broken Link
20120315 AST-2012-002: Remote Crash Vulnerability in Milliwatt Application

Source: MITRE
Type: CNA
CVE-2012-1183

Source: CONFIRM
Type: Patch, Vendor Advisory
http://downloads.asterisk.org/pub/security/AST-2012-002-1.8.diff

Source: CCN
Type: AST-2012-002
Remote Crash Vulnerability in Milliwatt Application

Source: CONFIRM
Type: Vendor Advisory
http://downloads.asterisk.org/pub/security/AST-2012-002.pdf

Source: OSVDB
Type: Broken Link
80125

Source: CCN
Type: SA48417
Asterisk Denial of Service and Buffer Overflow Vulnerabilities

Source: SECUNIA
Type: Broken Link
48417

Source: SECUNIA
Type: Broken Link
48941

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1026812

Source: CONFIRM
Type: Broken Link
http://www.asterisk.org/node/51797

Source: DEBIAN
Type: Third Party Advisory
DSA-2460

Source: DEBIAN
Type: DSA-2460
asterisk -- several vulnerabilities

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[oss-security] 20120316 CVE Request -- Asterisk: AST-2012-002 and AST-2012-003 flaws

Source: MLIST
Type: Mailing List, Patch, Third Party Advisory
[oss-security] 20120316 Re: CVE Request -- Asterisk: AST-2012-002 and AST-2012-003 flaws

Source: CCN
Type: OSVDB ID: 80125
Asterisk apps/app_milliwatt.c milliwatt_generate() Function Internal Data Sample Packet Parsing Remote DoS

Source: BID
Type: Third Party Advisory, VDB Entry
52523

Source: CCN
Type: BID-52523
Asterisk 'Milliwatt()' Denial Of Service Vulnerability

Source: XF
Type: Third Party Advisory, VDB Entry
asterisk-milliwattgenerate-dos(74082)

Source: XF
Type: UNKNOWN
asterisk-milliwattgenerate-dos(74082)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:digium:asterisk:*:*:*:*:*:*:*:* (Version >= 1.4.0 and < 1.4.44)
  • OR cpe:/a:digium:asterisk:*:*:*:*:*:*:*:* (Version >= 1.6.0 and < 1.6.2.23)
  • OR cpe:/a:digium:asterisk:*:*:*:*:*:*:*:* (Version >= 1.8.0 and < 1.8.10.1)
  • OR cpe:/a:digium:asterisk:*:*:*:*:*:*:*:* (Version >= 10.0.0 and < 10.2.1)

    • Configuration 2:
  • cpe:/o:debian:debian_linux:6.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:digium:asterisk:1.6.2.16:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.17.2:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.16.2:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.16.1:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.0:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.0:rc4:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.0:rc5:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.0:rc6:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.16:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.0:rc7:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.15:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.0:rc8:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.1:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.17:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.17.1:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.17:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.17:rc2:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.17:rc3:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.18:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.18:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.17.3:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.4:rc3:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.4:rc2:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.4:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.4:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.1:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.0:rc5:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.0:rc4:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.0:beta5:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.0:beta4:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.0:beta3:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.0:beta2:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.0:beta1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.0:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.2:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.3:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.1:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.3:rc3:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.3:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.3:rc2:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.4.4:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.5:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.5:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.6.0:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.6.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.6.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.6.0:rc3:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.7.0:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.7.0:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.7.0:rc2:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.8.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.19:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.19:rc1:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.20:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:1.6.2.21:*:*:*:*:*:*:*
  • OR cpe:/a:digium:asterisk:10.0.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:20181
    P
    		DSA-2460-1 asterisk - several
    2014-06-23
    oval:com.ubuntu.precise:def:20121183000
    V
    		CVE-2012-1183 on Ubuntu 12.04 LTS (precise) - medium.
    2012-09-18
    BACK
    digium asterisk *
    digium asterisk *
    digium asterisk *
    digium asterisk *
    debian debian linux 6.0
    digium asterisk 1.6.2.16
    digium asterisk 1.6.2.17.2
    digium asterisk 1.6.2.16.2
    digium asterisk 1.6.2.16.1
    digium asterisk 1.6.2.0
    digium asterisk 1.6.2.0 rc2
    digium asterisk 1.6.2.0 rc3
    digium asterisk 1.6.2.0 rc4
    digium asterisk 1.6.2.0 rc5
    digium asterisk 1.6.2.0 rc6
    digium asterisk 1.6.2.16 rc1
    digium asterisk 1.6.2.0 rc7
    digium asterisk 1.6.2.15 rc1
    digium asterisk 1.6.2.0 rc8
    digium asterisk 1.6.2.1
    digium asterisk 1.6.2.1 rc1
    digium asterisk 1.6.2.2
    digium asterisk 1.6.2.17
    digium asterisk 1.6.2.17.1
    digium asterisk 1.6.2.17 rc1
    digium asterisk 1.6.2.17 rc2
    digium asterisk 1.6.2.17 rc3
    digium asterisk 1.6.2.18 rc1
    digium asterisk 1.6.2.18
    digium asterisk 1.6.2.17.3
    digium asterisk 1.8.1.2
    digium asterisk 1.8.1.1
    digium asterisk 1.8.4 rc3
    digium asterisk 1.8.4 rc2
    digium asterisk 1.8.4 rc1
    digium asterisk 1.8.4
    digium asterisk 1.8.4.1
    digium asterisk 1.8.1 rc1
    digium asterisk 1.8.0 rc5
    digium asterisk 1.8.0 rc4
    digium asterisk 1.8.0 rc3
    digium asterisk 1.8.0 rc2
    digium asterisk 1.8.3.3
    digium asterisk 1.8.0 beta5
    digium asterisk 1.8.0 beta4
    digium asterisk 1.8.0 beta3
    digium asterisk 1.8.0 beta2
    digium asterisk 1.8.0 beta1
    digium asterisk 1.8.0
    digium asterisk 1.8.2.3
    digium asterisk 1.8.2.2
    digium asterisk 1.8.2.1
    digium asterisk 1.8.2
    digium asterisk 1.8.3
    digium asterisk 1.8.1
    digium asterisk 1.8.3 rc3
    digium asterisk 1.8.3.1
    digium asterisk 1.8.3 rc1
    digium asterisk 1.8.3 rc2
    digium asterisk 1.8.3.2
    digium asterisk 1.8.2.4
    digium asterisk 1.8.4.2
    digium asterisk 1.8.4.3
    digium asterisk 1.8.4.4
    digium asterisk 1.8.5
    digium asterisk 1.8.5 rc1
    digium asterisk 1.8.5.0
    digium asterisk 1.8.6.0
    digium asterisk 1.8.6.0 rc1
    digium asterisk 1.8.6.0 rc2
    digium asterisk 1.8.6.0 rc3
    digium asterisk 1.8.7.0
    digium asterisk 1.8.7.0 rc1
    digium asterisk 1.8.7.0 rc2
    digium asterisk 1.8.7.1
    digium asterisk 1.6.2.19
    digium asterisk 1.6.2.19 rc1
    digium asterisk 1.6.2.20
    digium asterisk 1.6.2.21
    digium asterisk 10.0.0