CVE-2012-2947 in Asterisk
Summary
by MITRE
chan_iax2.c in the IAX2 channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1, when a certain mohinterpret setting is enabled, allows remote attackers to cause a denial of service (daemon crash) by placing a call on hold.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 03/25/2021
The vulnerability identified as CVE-2012-2947 resides within the IAX2 channel driver implementation in Asterisk telephony software, specifically affecting certified versions 1.8.11-cert through 1.8.11-cert1 and open source versions 1.8.x through 1.8.12.0 and 10.x through 10.4.0. This flaw manifests when the mohinterpret setting is enabled, creating a critical condition that enables remote attackers to execute a denial of service attack against the telephony daemon. The vulnerability operates through a carefully crafted sequence of IAX2 protocol interactions that exploit a buffer handling inconsistency in the channel driver's call hold functionality.
The technical root cause stems from improper validation and handling of media on hold (moh) interpretation within the IAX2 channel driver's call hold processing mechanism. When a remote attacker initiates a call and places it on hold while the mohinterpret configuration is active, the system fails to properly validate incoming moh data structures. This leads to a memory corruption condition that ultimately results in the Asterisk daemon crashing and restarting. The flaw represents a classic buffer overflow condition that occurs during the interpretation of hold music data streams, where insufficient bounds checking allows malicious input to overwrite critical memory regions. This vulnerability directly maps to CWE-121, which describes heap-based buffer overflow conditions, and CWE-125, addressing out-of-bounds read vulnerabilities.
The operational impact of this vulnerability extends beyond simple service disruption, as it provides attackers with a reliable method to repeatedly crash the telephony infrastructure without requiring authentication or privileged access. This makes it particularly dangerous for organizations relying on Asterisk for mission-critical communications, as it can be exploited to maintain persistent service degradation. The attack vector is particularly concerning because it only requires the ability to place a call on hold, which is a fundamental telephony operation that occurs frequently in normal usage patterns. This vulnerability can be exploited by anyone with network access to the affected Asterisk system, making it an attractive target for both opportunistic attackers and those seeking to disrupt business communications. The daemon crash results in immediate loss of all active calls and prevents new call establishment until the service is manually restarted or the system automatically recovers.
Organizations should prioritize immediate patching of affected Asterisk installations to address this vulnerability, as the fix involves proper bounds checking and memory validation in the mohinterpret handling code. The recommended mitigation strategy includes updating to the patched versions of Asterisk 1.8.12.1, 10.4.1, or later releases that contain the necessary code modifications. Additionally, administrators should consider implementing network segmentation to limit access to IAX2 endpoints and disable unnecessary mohinterpret functionality where possible. The vulnerability demonstrates the importance of proper input validation in telephony protocols and aligns with ATT&CK technique T1499.004, which covers network denial of service attacks through exploitation of protocol implementation flaws. Organizations should also implement monitoring for unusual call hold patterns and daemon restart events that could indicate exploitation attempts, as these activities often precede successful attacks.