Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Asterisk SMS handling can crash the server

CVE-2013-7100 · published 12 years ago
Summary

Versions of Asterisk and its Digium phone add‑on that process 16‑bit SMS messages can be forced to loop endlessly, causing the service to stop. An attacker can send a specially crafted SMS with an odd number of bytes to trigger this condition. Updating to the latest released versions fixes the issue; apply the vendor’s patches as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
digium asterisk 1.8.17.0
1.8.18.0
1.8.18.1
1.8.19.0
1.8.19.1
1.8.20.0
1.8.21.0
1.8.22.0
1.8.23.0
10.10.0
10.11.0
10.12.0
13 more version ranges
cpe:2.3:a:digium:asterisk:1.8.17.0:*:*:*:*:*:*:*
digium asterisk_digiumphones 10.0.0
10.11.0
10.12.0
10.12.1
10.12.2
cpe:2.3:a:digium:asterisk_digiumphones:10.0.0:*:*:*:*:*:*:*
digium certified_asterisk 1.8.15
11.2.0
cpe:2.3:a:digium:certified_asterisk:1.8.15:*:*:*:*:*:*:*
Original advisory text
Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphone...
Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
4% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published19 Dec 2013
Updated25 Oct 2026
First seen29 Sep 2026
Sources
CVE-2013-7100 · NVD
Track software like this
Free during beta