CVE-2011-4063

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2011-10-21 · updated 2026-06-16
Weakness: CWE-20

Description

chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of service (daemon crash) via a malformed request.

Affected products

asterisk Open Source: 1.8.7, 10.0.0

References

http://downloads.digium.com/pub/security/AST-2011-012.html
http://secunia.com/advisories/46420
http://securityreason.com/securityalert/8478
http://www.securityfocus.com/archive/1/520141/100/0/threaded
http://www.securityfocus.com/bid/50177
http://www.securitytracker.com/id?1026191
https://exchange.xforce.ibmcloud.com/vulnerabilities/70706
http://downloads.digium.com/pub/security/AST-2011-012.html
http://secunia.com/advisories/46420
http://securityreason.com/securityalert/8478
http://www.securityfocus.com/archive/1/520141/100/0/threaded
http://www.securityfocus.com/bid/50177

Get alerted when CVE-2011-4063 or the next vulnerability affects your stack