PT-2006-2818 · Digium · Asterisk

Emmanouel Kellinis · Publicado 2006-04-18 · Atualizado 2011-03-08 · CVE-2006-1827

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asterisk versions 1.2.6 and earlier

Description The issue is caused by an integer signedness error in the format jpeg.c file, which allows remote attackers to execute arbitrary code. This is achieved by providing a length value that passes a length check as a negative number but triggers a buffer overflow when used as an unsigned length.

Recommendations For Asterisk versions 1.2.6 and earlier, update to a version later than 1.2.6 to resolve the issue.

Exploit

Correção

Identificadores relacionados

CVE-2006-1827

DSA-1048-1

Produtos afetados

Asterisk

Referências · 14

• 🔥 http://cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisory · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1827 · Nota de Segurança
• http://secunia.com/advisories/19897 · Nota
• http://vupen.com/english/advisories/2006/1478 · Nota
• http://securityfocus.com/bid/17561 · Nota
• http://debian.org/security/2006/dsa-1048 · Aviso do Fabricante
• http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.7-patch.gz · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1827 · Nota
• https://security-tracker.debian.org/tracker/CVE-2006-1827 · Aviso do Fabricante
• http://novell.com/linux/security/advisories/2006_04_28.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-1827 · Aviso do Fabricante
• http://secunia.com/advisories/19800 · Nota
• https://osv.dev/vulnerability/CVE-2006-1827 · Aviso do Fabricante
• http://secunia.com/advisories/19872 · Nota