CVE-2011-0495 in Asterisk
Summary
by MITRE
Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan function.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 01/19/2025
The CVE-2011-0495 vulnerability represents a critical stack-based buffer overflow affecting Asterisk Open Source and Business Edition installations across multiple version ranges. This flaw exists within the ast_uri_encode function located in main/utils.c, specifically when the application operates in pedantic mode. The vulnerability manifests when processing crafted caller ID data through three distinct attack vectors including the SIP channel driver, URIENCODE dialplan function, and AGI dialplan function. The buffer overflow occurs due to insufficient input validation and bounds checking in the URI encoding routine, allowing maliciously formatted caller ID information to overwrite adjacent stack memory locations. This type of vulnerability falls under CWE-121 Stack-based Buffer Overflow, which is classified as a fundamental memory safety issue where data written to a buffer exceeds the allocated stack space, potentially corrupting adjacent memory and enabling arbitrary code execution.
The operational impact of this vulnerability extends beyond simple privilege escalation as it allows remote authenticated attackers to achieve arbitrary code execution on affected systems. Attackers exploiting this vulnerability can leverage the buffer overflow to inject and execute malicious code within the Asterisk process context, potentially gaining full control over the telephony server. The pedantic mode requirement for exploitation indicates that the vulnerability is more likely to be triggered in environments where strict validation is enabled, making it particularly dangerous in production telephony systems where such security measures are commonly implemented. The attack vectors involving SIP channel driver, URIENCODE dialplan function, and AGI dialplan function demonstrate the widespread nature of the vulnerability across different Asterisk components and communication protocols.
From a cybersecurity perspective, this vulnerability aligns with ATT&CK technique T1059.007 for Command and Scripting Interpreter and T1068 for Exploitation for Privilege Escalation, as successful exploitation would enable attackers to execute arbitrary commands and potentially escalate privileges within the telephony infrastructure. The vulnerability's presence in both open source and business editions suggests a fundamental flaw in the core URI encoding logic that affects all installations regardless of licensing tier. Organizations running Asterisk systems in environments where authenticated users can submit caller ID information pose a significant risk, as the attack requires only authentication access rather than elevated privileges. The specific version ranges indicate that this vulnerability was addressed through multiple patch releases, demonstrating the severity of the issue and the need for prompt remediation across all affected installations.
Mitigation strategies should prioritize immediate patching of all affected Asterisk versions to the latest stable releases containing the fix for CVE-2011-0495. System administrators should also implement network segmentation to limit access to telephony services and restrict authentication privileges to only necessary personnel. Monitoring for suspicious caller ID patterns and implementing input validation at multiple layers can help detect potential exploitation attempts. Additionally, organizations should conduct thorough vulnerability assessments of their telephony infrastructure to identify any other potential buffer overflow vulnerabilities in similar components. The remediation process should include disabling pedantic mode if it's not essential for operations, as this mode was required for the vulnerability to be exploitable, thereby reducing the attack surface while maintaining operational security.