Red Hat Bugzilla – Bug 1074827
CVE-2014-2287 asterisk: remote denial of service via file descriptor exhaustion (AST-2014-002)
Last modified: 2015-07-31 03:16:33 EDT
A remote denial of service flaw was found in Asterisk. This could be used to cause Asterisk to hit the open file descriptor limit, preventing it from handling further requests. The upstream advisory (http://downloads.asterisk.org/pub/security/AST-2014-002.html) notes the attacker requires "Valid account credentials or anonymous dial in" and "A valid extension that can be dialed from the SIP account".
This issue affected all 1.8.x and 11.x versions. It has been corrected in versions 220.127.116.11 and 11.8.1.
Created asterisk tracking bugs for this issue:
Affects: fedora-all [bug 1074828]
Affects: epel-6 [bug 1074829]
asterisk-11.8.1-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
asterisk-11.8.1-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.