PT-2007-3061 · Yate · Yate

Yuri Gushin · Publicado 2007-05-17 · Atualizado 2018-11-29 · CVE-2007-1693

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Yate versions prior to 1.2.0

Description: The issue is related to the SIP channel module in Yate, where an incorrect variable is used to set the caller info uri parameter. This variable can be NULL, allowing remote attackers to cause a denial of service by sending a Call-Info header without a purpose parameter, resulting in a NULL dereference and application crash.

Recommendations: For versions prior to 1.2.0, update to version 1.2.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the SIP channel module to minimize the risk of exploitation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-1693

Produtos afetados

Yate

Referências · 5

• 🔥 http://securityreason.com/securityalert/2716 · Exploit
• http://securityfocus.com/bid/23746 · Nota
• http://securityfocus.com/archive/1/467289/100/200/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-1693 · Nota de Segurança
• http://voip.null.ro/cgi-bin/cvsweb.cgi/yate/modules/ysipchan.cpp · Nota