Bug 9583

======================================================
Name: CVE-2013-2264
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2264
Final-Decision: 
Interim-Decision: 
Modified: 
Proposed: 
Assigned: 20130220
Category: 
Reference: CONFIRM:http://downloads.asterisk.org/pub/security/AST-2013-003.html
Reference: CONFIRM:https://issues.asterisk.org/jira/browse/ASTERISK-21013

The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2,
10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15
before 1.8.15-cert2; Asterisk Business Edition (BE) C.3.x before
C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before
10.12.2-digiumphones exhibits different behavior for invalid INVITE,
SUBSCRIBE, and REGISTER transactions depending on whether the user
account exists, which allows remote attackers to enumerate account
names by (1) reading HTTP status codes, (2) reading additional text in
a 403 (aka Forbidden) response, or (3) observing whether certain
retransmissions occur.



======================================================
Name: CVE-2013-2685
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2685
Final-Decision: 
Interim-Decision: 
Modified: 
Proposed: 
Assigned: 20130325
Category: 
Reference: CONFIRM:http://downloads.asterisk.org/pub/security/AST-2013-001.html
Reference: CONFIRM:https://issues.asterisk.org/jira/browse/ASTERISK-20901

Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk
Open Source 11.x before 11.2.2 allows remote attackers to execute
arbitrary code via a long sprop-parameter-sets H.264 media attribute
in a SIP Session Description Protocol (SDP) header.



======================================================
Name: CVE-2013-2686
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2686
Final-Decision: 
Interim-Decision: 
Modified: 
Proposed: 
Assigned: 20130325
Category: 
Reference: MISC:http://telussecuritylabs.com/threats/show/TSL20130327-01
Reference: CONFIRM:http://downloads.asterisk.org/pub/security/AST-2013-002.html
Reference: CONFIRM:https://issues.asterisk.org/jira/browse/ASTERISK-20967

main/http.c in the HTTP server in Asterisk Open Source 1.8.x before
1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified
Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones
10.x-digiumphones before 10.12.2-digiumphones does not properly
restrict Content-Length values, which allows remote attackers to
conduct stack-consumption attacks and cause a denial of service
(daemon crash) via a crafted HTTP POST request.  NOTE: this
vulnerability exists because of an incorrect fix for CVE-2012-5976.



Reproducible: 

Steps to Reproduce: