CVE-2011-1175
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1...
CVE-2011-1175 is a medium vulnerability (CVSS 5.0) in Digium Asterisk, published March 31, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.72%, the 86th percentile. Fixed in asterisk 1:1.8.3.3-1.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.72%EPSS, 86th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:1.8.3.3-1asterisk +2 more
Description
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
asteriskDebian:14 | before 1:1.8.3.3-1, plus listed versions 0.1.11-30.1.11-3woody11:1.0.5-21:1.0.5-41:1.0.6-1 Show 45 moreShow less1:1.0.6-21:1.0.7-11:1.0.7.dfsg.1-11:1.0.7.dfsg.1-21:1.0.7.dfsg.1-2sarge11:1.0.7.dfsg.1-2sarge21:1.0.7.dfsg.1-2sarge31:1.0.7.dfsg.1-2sarge41:1.0.7.dfsg.1-2sarge51:1.0.7.dfsg.1-2sarge61:1.0.9.dfsg-11:1.0.9.dfsg-31:1.0.9.dfsg-41:1.0.9.dfsg-51:1.0.9.dfsg-61:1.2.0-beta1.dfsg-11:1.2.0-beta2.dfsg-11:1.2.0-beta2.dfsg-21:1.2.0-beta2.dfsg-31:1.2.0-rc1.dfsg-11:1.2.0-rc2.dfsg-11:1.2.0.dfsg-11:1.2.0.dfsg-21:1.2.0.dfsg-31:1.2.0.dfsg-41:1.2.0.dfsg-51:1.2.0.dfsg-61:1.2.1.dfsg-11:1.2.1.dfsg-21:1.2.1.dfsg-31:1.2.10.dfsg-11:1.2.10.dfsg-1bpo11:1.2.10.dfsg-21:1.2.10.dfsg-31:1.2.11.dfsg-11:1.2.12.1.dfsg-11:1.2.13~dfsg-11:1.2.13~dfsg-21:1.2.13~dfsg-2etch11:1.2.13~dfsg-2etch21:1.2.13~dfsg-2etch31:1.2.13~dfsg-2etch41:1.2.14~dfsg-11:1.2.14~dfsg-21:1.2.14~dfsg-3 | 1:1.8.3.3-1 |
asteriskDebian:5.0 From an advisory covering 5 CVEs | before 1:1.4.21.2~dfsg-3+lenny2.1, plus listed versions 1:1.4.21.2~dfsg-31:1.4.21.2~dfsg-3+lenny11:1.4.21.2~dfsg-3+lenny2 | 1:1.4.21.2~dfsg-3+lenny2.1 |
asteriskDebian:6.0 From an advisory covering 5 CVEs | before 1:1.6.2.9-2+squeeze2, plus listed versions 1:1.6.2.9-21:1.6.2.9-2+squeeze1 | 1:1.6.2.9-2+squeeze2 |
What each source reports
NVD Score used
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.
- Record
CVE-2011-1175- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE ListNo score
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.
- Record
CVE-2011-1175- Updated
- 2026-11-02
EUVDEUVD-2011-1185No score
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.
- Record
EUVD-2011-1185- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cfj4-pwcj-qhgcNo score
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1...
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.
- Record
GHSA-cfj4-pwcj-qhgc- Updated
- 2026-11-02
OSVNo score
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.
- Record
CVE-2011-1175- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-1175No score
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.
- Record
DEBIAN-CVE-2011-1175- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
lists.fedoraproject.org/pipermail/package-announce/2011-March/057156.html
exchange.xforce.ibmcloud.com/vulnerabilities/66140
downloads.asterisk.org/pub/security/AST-2011-004.html
debian.org/security/2011/dsa-2225
openwall.com/lists/oss-security/2011/03/17/5
Show 10 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=688678
vupen.com/english/advisories/2011/0686
securitytracker.com/id?1025224
securityfocus.com/bid/46898
nvd.nist.gov/vuln/detail/CVE-2011-1175
github.com/advisories/GHSA-cfj4-pwcj-qhgc
security-tracker.debian.org/tracker/CVE-2011-1175
Left out here: 85 versions. The JSON record has them.