CVE-2014-2287 in Asterisk
Summary
by MITRE
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/11/2026
The vulnerability identified as CVE-2014-2287 affects the SIP channel driver in Asterisk Open Source and Certified Asterisk versions prior to specific patched releases. This issue resides within the channels/chan_sip.c file and represents a denial of service weakness that can be exploited by authenticated remote attackers who have access to the SIP signaling interface. The vulnerability specifically targets systems where chan_sip is configured with certain parameters that enable processing of Session-Expires and Min-SE headers in SIP INVITE requests. According to CWE-400, this represents an improper input validation flaw that allows resource exhaustion through malformed header values.
The technical flaw manifests when the SIP channel driver processes INVITE requests containing either Session-Expires or Min-SE headers with invalid or malformed values. The system fails to properly validate these header parameters, leading to excessive consumption of system resources including channel allocations and file descriptors. This resource exhaustion ultimately results in a denial of service condition where legitimate users cannot establish new SIP sessions or the system becomes unresponsive to incoming calls. The vulnerability operates at the protocol parsing level where the Asterisk application fails to implement adequate bounds checking and input sanitization for SIP header values.
From an operational perspective, this vulnerability presents a significant risk to telephony infrastructure that relies on Asterisk for SIP communications. Attackers with valid SIP credentials can exploit this weakness to consume system resources systematically, potentially causing cascading failures in communication services. The impact extends beyond simple service disruption as the resource consumption can lead to system instability and may require manual intervention to restore normal operations. The vulnerability affects multiple release streams including 1.8.x, 11.8.x, and 12.1.x versions, indicating a widespread issue across the Asterisk codebase that required patching across several major version lines.
Security professionals should note that this vulnerability aligns with ATT&CK technique T1499.004 which covers network denial of service attacks. The attack vector requires authentication, making it a privileged denial of service rather than a simple public exploit. Organizations should implement immediate mitigations including applying the relevant patches for versions 1.8.26.1, 11.8.1, 12.1.1, 1.8.15-cert5, and 11.6-cert2. Network segmentation and monitoring of SIP traffic for malformed headers can provide additional defense in depth. The vulnerability demonstrates the importance of input validation in telephony applications and serves as a reminder that even authenticated attackers can cause significant disruption through resource exhaustion attacks. This issue highlights the need for robust error handling in signaling protocols and proper resource management in telephony systems to prevent attackers from consuming system resources through carefully crafted SIP messages.