CVE-2013-5642
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x...
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
Exploit likelihood
What each source reports
NVD Score used
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
- Record
CVE-2013-5642- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
- Record
CVE-2013-5642- Updated
- 2026-11-02
EUVDEUVD-2013-5482 No score
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
- Record
EUVD-2013-5482- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mj2h-m66w-4g7r No score
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x...
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
- Record
GHSA-mj2h-m66w-4g7r- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
- Record
CVE-2013-5642- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-5642 No score
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
- Record
DEBIAN-CVE-2013-5642- Updated
- 2026-11-02
OSVMGASA-2013-0266 No score
Updated asterisk package fixes security vulnerabilities
A remotely exploitable crash vulnerability exists in the SIP channel driver if an ACK with SDP is received after the channel has been terminated. The handling code incorrectly assumes that the channel will always be present (CVE-2013-5641).
A remotely exploitable crash vulnerability exists in the SIP channel driver if an invalid SDP is sent in a SIP request that defines media descriptions before connection information. The handling code incorrectly attempts to reference the socket address information even though that information has not yet been set (CVE-2013-5642).
- Record
MGASA-2013-0266- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-5642 No score
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.
- Record
UBUNTU-CVE-2013-5642- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 |
before 1:11.5.1~dfsg-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 |
1:11.5.1~dfsg-1 |
asteriskDebian:6.0 From an advisory covering 2 CVEs |
before 1:1.6.2.9-2+squeeze11, plus listed versions 1:1.6.2.9-21:1.6.2.9-2+squeeze11:1.6.2.9-2+squeeze101:1.6.2.9-2+squeeze21:1.6.2.9-2+squeeze3 Show 6 moreShow less1:1.6.2.9-2+squeeze41:1.6.2.9-2+squeeze51:1.6.2.9-2+squeeze61:1.6.2.9-2+squeeze71:1.6.2.9-2+squeeze81:1.6.2.9-2+squeeze9 |
1:1.6.2.9-2+squeeze11 |
asteriskDebian:7 From an advisory covering 2 CVEs |
before 1:1.8.13.1~dfsg-3+deb7u1, plus listed versions 1:1.8.13.1~dfsg-3 |
1:1.8.13.1~dfsg-3+deb7u1 |
asteriskMageia:3 From an advisory covering 2 CVEs |
before 11.5.1-1.mga3 | 11.5.1-1.mga3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-5642 is a medium vulnerability (CVSS 5.0) in Digium Asterisk, published August 30, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 11.7%, the 96th percentile. Fixed in asterisk 1:11.5.1~dfsg-1.
References
secunia.com/advisories/54534
osvdb.org/96690
downloads.asterisk.org/pub/security/AST-2013-005.html
debian.org/security/2013/dsa-2749
issues.asterisk.org/jira/browse/ASTERISK-22007
Show 13 moreShow less
securitytracker.com/id/1028957
securityfocus.com/bid/62022
archives.neohapsis.com/archives/bugtraq/2013-08/0174.html
mandriva.com/security/advisories?name=MDVSA-2013:223
nvd.nist.gov/vuln/detail/CVE-2013-5642
github.com/advisories/GHSA-mj2h-m66w-4g7r
security-tracker.debian.org/tracker/CVE-2013-5642
advisories.mageia.org/MGASA-2013-0266.html
bugs.mageia.org/show_bug.cgi?id=11094
ubuntu.com/security/CVE-2013-5642
openwall.com/lists/oss-security/2013/08/28
cve.org/CVERecord?id=CVE-2013-5642
Left out here: 106 versions. The JSON record has them.