{"id":"CVE-2013-7100","aliases":["DEBIAN-CVE-2013-7100","DSA-2835-1","EUVD-2013-6886","GHSA-6wfw-q7f5-wr2c","MGASA-2013-0384","MGASA-2014-0171","UBUNTU-CVE-2013-7100"],"status":"published","title":"Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x...","description":"Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04313,"percentile":0.91222,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2013-12-19T22:00:00Z","modified":"2026-09-01T20:03:19Z","fixes":[{"ecosystem":"Debian:14","package":"asterisk","fixed_in":["1:11.7.0~dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"asterisk","fixed_in":["1:1.6.2.9-2+squeeze12"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"asterisk","fixed_in":["1:1.8.13.1~dfsg1-3+deb7u3"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"asterisk","fixed_in":["11.7.0-1.mga3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"asterisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:11.7.0~dfsg-1"}]}],"versions":["0.1.11-3","0.1.11-3woody1","1:1.0.5-2","1:1.0.5-4","1:1.0.6-1","1:1.0.6-2","1:1.0.7-1","1:1.0.7.dfsg.1-1","1:1.0.7.dfsg.1-2","1:1.0.7.dfsg.1-2sarge1","1:1.0.7.dfsg.1-2sarge2","1:1.0.7.dfsg.1-2sarge3","1:1.0.7.dfsg.1-2sarge4","1:1.0.7.dfsg.1-2sarge5","1:1.0.7.dfsg.1-2sarge6","1:1.0.9.dfsg-1","1:1.0.9.dfsg-3","1:1.0.9.dfsg-4","1:1.0.9.dfsg-5","1:1.0.9.dfsg-6","1:1.2.0-beta1.dfsg-1","1:1.2.0-beta2.dfsg-1","1:1.2.0-beta2.dfsg-2","1:1.2.0-beta2.dfsg-3","1:1.2.0-rc1.dfsg-1","1:1.2.0-rc2.dfsg-1","1:1.2.0.dfsg-1","1:1.2.0.dfsg-2","1:1.2.0.dfsg-3","1:1.2.0.dfsg-4","1:1.2.0.dfsg-5","1:1.2.0.dfsg-6","1:1.2.1.dfsg-1","1:1.2.1.dfsg-2","1:1.2.1.dfsg-3","1:1.2.10.dfsg-1","1:1.2.10.dfsg-1bpo1","1:1.2.10.dfsg-2","1:1.2.10.dfsg-3","1:1.2.11.dfsg-1","1:1.2.12.1.dfsg-1","1:1.2.13~dfsg-1","1:1.2.13~dfsg-2","1:1.2.13~dfsg-2etch1","1:1.2.13~dfsg-2etch2","1:1.2.13~dfsg-2etch3","1:1.2.13~dfsg-2etch4","1:1.2.14~dfsg-1","1:1.2.14~dfsg-2","1:1.2.14~dfsg-3","1:1.2.14~dfsg-4","1:1.2.15~dfsg-1","1:1.2.16~dfsg-1","1:1.2.17~dfsg-1","1:1.2.4.dfsg-1","1:1.2.4.dfsg-2","1:1.2.4.dfsg-3","1:1.2.4.dfsg-4","1:1.2.4.dfsg-5","1:1.2.4.dfsg-6","1:1.2.4.dfsg-6+b1","1:1.2.4.dfsg-7","1:1.2.7.1.dfsg-1","1:1.2.7.1.dfsg-2","1:1.2.7.1.dfsg-3","1:1.2.9.1.dfsg-1","1:1.4.10~dfsg-1","1:1.4.11~dfsg-1","1:1.4.11~dfsg-2","1:1.4.11~dfsg-3","1:1.4.11~dfsg-4","1:1.4.13~dfsg-1","1:1.4.15~dfsg-1","1:1.4.16.2~dfsg-1","1:1.4.16.2~dfsg-2","1:1.4.17~dfsg-1","1:1.4.17~dfsg-2","1:1.4.18.1~dfsg-1","1:1.4.18~dfsg-1","1:1.4.19.1~dfsg-1","1:1.4.20~dfsg-1","1:1.4.21.1~dfsg-1","1:1.4.21.2~dfsg-1","1:1.4.21.2~dfsg-2","1:1.4.21.2~dfsg-3","1:1.4.21.2~dfsg-3+lenny1","1:1.4.21.2~dfsg-3+lenny2","1:1.4.21.2~dfsg-3+lenny2.1","1:1.4.21.2~dfsg-3+lenny3","1:1.4.21.2~dfsg-3+lenny5","1:1.4.21.2~dfsg-3+lenny6","1:1.4.21.2~dfsg-3.1","1:1.4.2~dfsg-1","1:1.4.2~dfsg-2","1:1.4.2~dfsg-3","1:1.4.2~dfsg-4","1:1.4.2~dfsg-5","1:1.4.3~dfsg-1","1:1.4.4~dfsg-1","1:1.4.4~dfsg-2","1:1.4.4~dfsg-3","1:1.4.5~dfsg-1","1:1.4.6~dfsg-1","1:1.4.8~dfsg-1","1:1.4.8~dfsg-2","1:1.4.9~dfsg-1","1:1.6.1.0~dfsg-1","1:1.6.1.0~dfsg~rc3-1","1:1.6.2.0-1","1:1.6.2.0~dfsg~beta3-1","1:1.6.2.0~dfsg~rc1-1","1:1.6.2.0~rc3-1","1:1.6.2.0~rc3-2","1:1.6.2.0~rc6-1","1:1.6.2.0~rc7-1","1:1.6.2.2-1","1:1.6.2.6-1","1:1.6.2.7-1","1:1.6.2.9-1","1:1.6.2.9-1~bpo50+1","1:1.6.2.9-1~bpo50+2","1:1.6.2.9-1~bpo50+3","1:1.6.2.9-2","1:1.6.2.9-2+squeeze1","1:1.6.2.9-2+squeeze10","1:1.6.2.9-2+squeeze11","1:1.6.2.9-2+squeeze12","1:1.6.2.9-2+squeeze2","1:1.6.2.9-2+squeeze3","1:1.6.2.9-2+squeeze4","1:1.6.2.9-2+squeeze5","1:1.6.2.9-2+squeeze6","1:1.6.2.9-2+squeeze7","1:1.6.2.9-2+squeeze8","1:1.6.2.9-2+squeeze9","1:1.8.10.0~dfsg-1","1:1.8.10.1~dfsg-1","1:1.8.11.1~dfsg-1","1:1.8.13.0~dfsg-1","1:1.8.13.0~dfsg-1~bpo60+1","1:1.8.13.1~dfsg-1","1:1.8.13.1~dfsg-1+powerpcspe1","1:1.8.13.1~dfsg-1~bpo60+1","1:1.8.13.1~dfsg-2","1:1.8.13.1~dfsg-3","1:1.8.3.3-1","1:1.8.4-1","1:1.8.4.2-1","1:1.8.4.3-1","1:1.8.4.4~dfsg-1","1:1.8.4.4~dfsg-2","1:1.8.7.1~dfsg-1","1:1.8.7.1~dfsg-2","1:1.8.7.1~dfsg-3","1:1.8.8.0~dfsg-1","1:1.8.8.2~dfsg-1","1:11.5.1~dfsg-1","1:11.5.1~dfsg-2","1:11.5.1~dfsg1-1","1:11.5.1~dfsg1-1~bpo70+1","1:11.6.0~dfsg-1","1:11.6.0~dfsg-2","1:11.6.0~dfsg-3","1:11.7.0~dfsg-1~bpo70+1"]},{"source":"osv","ecosystem":"Debian:6.0","package":"asterisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.6.2.9-2+squeeze12"}]}],"versions":["1:1.6.2.9-2","1:1.6.2.9-2+squeeze1","1:1.6.2.9-2+squeeze10","1:1.6.2.9-2+squeeze11","1:1.6.2.9-2+squeeze2","1:1.6.2.9-2+squeeze3","1:1.6.2.9-2+squeeze4","1:1.6.2.9-2+squeeze5","1:1.6.2.9-2+squeeze6","1:1.6.2.9-2+squeeze7","1:1.6.2.9-2+squeeze8","1:1.6.2.9-2+squeeze9"]},{"source":"osv","ecosystem":"Debian:7","package":"asterisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.8.13.1~dfsg1-3+deb7u3"}]}],"versions":["1:1.8.13.1~dfsg-3","1:1.8.13.1~dfsg-3+deb7u1","1:1.8.13.1~dfsg-3+deb7u2"]},{"source":"osv","ecosystem":"Mageia:3","package":"asterisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.7.0-1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"asterisk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.8.1-1.mga3"}]}],"bundled":3}],"products":[{"vendor":"digium","product":"asterisk"},{"vendor":"digium","product":"asterisk_digiumphones"},{"vendor":"digium","product":"certified_asterisk"}],"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2013:300","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2013-12/0089.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"https://issues.asterisk.org/jira/browse/ASTERISK-22590","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix","report"]},{"url":"http://secunia.com/advisories/56294","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://downloads.asterisk.org/pub/security/AST-2013-006.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"http://www.securitytracker.com/id/1029499","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://osvdb.org/101100","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-2835","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.securityfocus.com/bid/64364","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89825","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7100"},{"url":"https://github.com/advisories/GHSA-6wfw-q7f5-wr2c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-7100","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0384.html","tags":["advisory"]},{"url":"http://downloads.asterisk.org/pub/telephony/asterisk/asterisk-11.7.0-summary.html","tags":["web"]},{"url":"http://www.mandriva.com/en/support/security/advisories/mbs1/MDVSA-2013:300/","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12060","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0171.html","tags":["advisory"]},{"url":"http://downloads.asterisk.org/pub/security/AST-2013-007.html","tags":["web"]},{"url":"http://downloads.asterisk.org/pub/security/AST-2014-001.html","tags":["web"]},{"url":"http://downloads.asterisk.org/pub/security/AST-2014-002.html","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13061","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-7100","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7100","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-7100","description":"Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.","status":"published","published":"2013-12-19T22:00:00Z","modified":"2024-08-06T17:53:45.993Z","updated_at":"2026-11-02T14:34:59.222149Z"}],"euvd":[{"id":"EUVD-2013-6886","description":"Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.","status":"published","published":"2013-12-19T22:00:00Z","modified":"2024-08-06T17:53:45Z","updated_at":"2026-11-03T01:56:24.379982Z"}],"ghsa":[{"id":"GHSA-6wfw-q7f5-wr2c","title":"Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x...","description":"Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.","status":"published","published":"2022-05-17T01:29:43Z","modified":"2023-02-03T05:04:20Z","cwes":["CWE-119"],"updated_at":"2026-11-02T14:53:31.794753Z"}],"nvd":[{"id":"CVE-2013-7100","description":"Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.","status":"published","published":"2013-12-19T22:55:04.57Z","modified":"2026-06-17T00:01:25.167Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:02:44.596064Z"}],"osv":[{"id":"CVE-2013-7100","description":"Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.","status":"published","published":"2013-12-19T22:55:04Z","modified":"2026-04-16T06:26:10.471586111Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2013-7100","description":"Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.","status":"published","published":"2013-12-19T22:55:04.57Z","modified":"2026-09-01T20:03:19.178638685Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2835-1","title":"asterisk - buffer overflow","status":"published","published":"2014-01-05T00:00:00Z","modified":"2026-03-09T01:22:12.286482Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2013-0384","title":"Updated asterisk packages fix CVE-2013-7100","description":"Updated asterisk packages fix security vulnerability:\n\nBuffer overflow in the unpacksms16 function in apps/app_sms.c in\nAsterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and\n11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before\n10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4\nand 11.x before 11.2-cert3 allows remote attackers to cause a denial\nof service (daemon crash) via a 16-bit SMS message (CVE-2013-7100).\n\nThe updated packages has been upgraded to the 11.7.0 version which\nresolves various upstream bugs and is not vulnerable to this issue.\n","status":"published","published":"2013-12-23T17:15:47Z","modified":"2026-04-16T06:25:14.366737567Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0171","title":"Updated asterisk packages fix security vulnerabilities","description":"Updated asterisk packages fix security vulnerabilities:\n\nIn Asterisk before 11.6.1, a 16 bit SMS message that contains an odd message\nlength value will cause the message decoding loop to run forever. The message\nbuffer is not on the stack but will be overflowed resulting in corrupted\nmemory and an immediate crash (CVE-2013-7100).\n\nIn Asterisk before 11.6.1, external control protocols, such as the Asterisk\nManager Interface, often have the ability to get and set channel variables;\nthis allows the execution of dialplan functions. Reading the SHELL() function\ncan execute arbitrary commands on the system Asterisk is running on. Writing\nto the FILE() function can change any file that Asterisk has write access to.\nWhen these functions are executed from an external protocol, that execution\ncould result in a privilege escalation (AST-2013-007).\n\nIn Asterisk before 11.8.1, sending a HTTP request that is handled by Asterisk\nwith a large number of Cookie headers could overflow the stack. You could\neven exhaust memory if you sent an unlimited number of headers in the request\n(CVE-2014-2286).\n\nIn Asterisk before 11.8.1, an attacker can use all available file descriptors\nusing SIP INVITE requests. Each INVITE meeting certain conditions will leak a\nchannel and several file descriptors. The file descriptors cannot be released\nwithout restarting Asterisk which may allow intrusion detection systems to be\nbypassed by sending the requests slowly (CVE-2014-2287).\n","status":"published","published":"2014-04-15T18:22:45Z","modified":"2026-04-16T06:25:35.214063059Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2013-7100","description":"Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.","status":"withdrawn","published":"2013-12-19T22:55:00Z","modified":"2025-07-16T07:31:30.638981Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}