CVE-2015-1558

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2015-02-09 · updated 2026-06-17
Weakness: CWE-399

Description

Asterisk Open Source 12.x before 12.8.1 and 13.x before 13.1.1, when using the PJSIP channel driver, does not properly reclaim RTP ports, which allows remote authenticated users to cause a denial of service (file descriptor consumption) via an SDP offer containing only incompatible codecs.

Affected products

Digium Asterisk: 12.0.0, 12.1.0, 12.1.0-rc1, 12.1.0-rc2, 12.1.0-rc3, 12.1.1 (+28)

References

http://downloads.asterisk.org/pub/security/AST-2015-001.html
http://seclists.org/fulldisclosure/2015/Jan/116
http://www.securityfocus.com/archive/1/534573/100/0/threaded
http://www.securitytracker.com/id/1031661
http://downloads.asterisk.org/pub/security/AST-2015-001.html
http://seclists.org/fulldisclosure/2015/Jan/116
http://www.securityfocus.com/archive/1/534573/100/0/threaded
http://www.securitytracker.com/id/1031661

Get alerted when CVE-2015-1558 or the next vulnerability affects your stack