PT-2007-3812 · Digium · Asterisk

Publicado 2007-05-07 · Atualizado 2017-07-29 · CVE-2007-2488

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20070504

Description The issue is related to the IAX2 channel driver, which does not properly null terminate data. This allows remote attackers to trigger loss of transmitted data, and possibly obtain sensitive information, such as memory contents, or cause a denial of service, resulting in an application crash, by sending a frame that lacks a 0 byte.

Recommendations For versions prior to 20070504, update to a version released after 20070504 to resolve the issue.

Correção

Identificadores relacionados

CVE-2007-2488

DSA-1358-1

Produtos afetados

Asterisk

Referências · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2007-2488 · Aviso do Fabricante
• http://novell.com/linux/security/advisories/2007_34_asterisk.html · Aviso do Fabricante
• http://securityfocus.com/bid/23824 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34085 · Nota
• https://security-tracker.debian.org/tracker/CVE-2007-2488 · Aviso do Fabricante
• http://secunia.com/advisories/25134 · Nota
• http://osvdb.org/35769 · Nota
• http://secunia.com/advisories/25582 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2488 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2488 · Nota
• https://osv.dev/vulnerability/CVE-2007-2488 · Aviso do Fabricante
• http://debian.org/security/2007/dsa-1358 · Aviso do Fabricante
• http://ftp.digium.com/pub/asa/ASA-2007-013.pdf · Nota
• http://vupen.com/english/advisories/2007/1661 · Nota