Vulnerability DatabaseCVE-2014-2288
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2014-2288
Published:April 18, 2014
Updated:May 17, 2026
The PJSIP channel driver in Asterisk Open Source 12.x before 12.1.1, when qualify_frequency "is enabled on an AOR and the remote SIP server challenges for authentication of the resulting OPTIONS request," allows remote attackers to cause a denial of service (crash) via a PJSIP endpoint that does not have an associated outgoing request.
Related Resources (6)
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130426.html
https://issues.asterisk.org/jira/browse/ASTERISK-23210
http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130400.html
http://downloads.asterisk.org/pub/security/AST-2014-003-12.diff
https://people.canonical.com/~ubuntu-security/cve/CVE-2014-2288
http://downloads.asterisk.org/pub/security/AST-2014-003.html
Do you need more information?
Contact Us
CVSS v3
Base Score:
3.7
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
LOW
CVSS v2
Base Score:
4.3
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
Weakness Type (CWE)
Improper Input Validation
CWE-20
EPSS
Base Score:
7.48