Secunia

A vulnerability has been reported in Asterisk, which can be exploited by malicious people to cause a DoS (Denial of Service).

The vulnerability is caused due to a NULL-pointer dereference error in the "ast_uri_decode()" function. This can be exploited to crash the application via a SIP message lacking a "From" field.

Successful exploitation requires that "pedantic" processing is enabled.

The vulnerability is reported in the following products:
* Asterisk Open Source 1.0.x (all versions)
* Asterisk Open Source 1.2.x (all versions prior to 1.2.29)
* Asterisk Business Edition A.x.x (all versions)
* Asterisk Business Edition B.x.x (all versions prior to B.2.5.3)

Solution
Asterisk Open Source:
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Hooi Ng.

Original Advisory
http://downloads.digium.com/pub/security/AST-2008-008.html

http://bugs.digium.com/view.php?id=12607

Deep Links
Links available in Customer Area