CVE-2011-1507

Name	CVE-2011-1507
Description	Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial of service (file descriptor exhaustion and disk space exhaustion) via a series of TCP connections.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-2225-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
asterisk (PTS)	jessie, jessie (lts)	1:11.13.1~dfsg-2+deb8u8	fixed
	stretch (security)	1:13.14.1~dfsg-2+deb9u6	fixed
	stretch (lts), stretch	1:13.14.1~dfsg-2+deb9u10	fixed
	buster, buster (lts)	1:16.28.0~dfsg-0+deb10u5	fixed
	buster (security)	1:16.28.0~dfsg-0+deb10u4	fixed
	bullseye	1:16.28.0~dfsg-0+deb11u4	fixed
	bullseye (security)	1:16.28.0~dfsg-0+deb11u5	fixed
	sid	1:22.0.0~dfsg+~cs6.14.60671435-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
asterisk	source	lenny	1:1.4.21.2~dfsg-3+lenny2.1		DSA-2225-1
asterisk	source	squeeze	1:1.6.2.9-2+squeeze2		DSA-2225-1
asterisk	source	(unstable)	1:1.8.3.3-1