A remote denial of service flaw was found in Asterisk. This could be used to cause Asterisk to hit the open file descriptor limit, preventing it from handling further requests. The upstream advisory (http://downloads.asterisk.org/pub/security/AST-2014-002.html) notes the attacker requires "Valid account credentials or anonymous dial in" and "A valid extension that can be dialed from the SIP account". This issue affected all 1.8.x and 11.x versions. It has been corrected in versions 1.8.26.1 and 11.8.1. Upstream patches: http://downloads.asterisk.org/pub/security/AST-2014-002-1.8.diff http://downloads.asterisk.org/pub/security/AST-2014-002-11.diff External References: http://downloads.asterisk.org/pub/security/AST-2014-002.html
Created asterisk tracking bugs for this issue: Affects: fedora-all [bug 1074828] Affects: epel-6 [bug 1074829]
asterisk-11.8.1-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
asterisk-11.8.1-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.
This CVE Bugzilla entry is for community support informational purposes only as it does not affect a package in a commercially supported Red Hat product. Refer to the dependent bugs for status of those individual community products.