PT-2006-2818 · Digium · Asterisk

Emmanouel Kellinis · Published 2006-04-18 · Updated 2011-03-08 · CVE-2006-1827

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Asterisk versions 1.2.6 and earlier

Description The issue is caused by an integer signedness error in the format jpeg.c file, which allows remote attackers to execute arbitrary code. This is achieved by providing a length value that passes a length check as a negative number but triggers a buffer overflow when used as an unsigned length.

Recommendations For Asterisk versions 1.2.6 and earlier, update to a version later than 1.2.6 to resolve the issue.

Exploit

Fix

Related Identifiers

CVE-2006-1827

DSA-1048-1

Affected Products

Asterisk

References · 14

• 🔥 http://cipher.org.uk/index.php?p=advisories/Asterisk_Codec_Integer_Overflow_07-04-2006.advisory · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2006-1827 · Security Note
• http://debian.org/security/2006/dsa-1048 · Vendor Advisory
• http://ftp.digium.com/pub/asterisk/releases/asterisk-1.2.7-patch.gz · Patch
• https://security-tracker.debian.org/tracker/CVE-2006-1827 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_04_28.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2006-1827 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2006-1827 · Vendor Advisory
• http://secunia.com/advisories/19897 · Note
• http://vupen.com/english/advisories/2006/1478 · Note
• http://securityfocus.com/bid/17561 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1827 · Note
• http://secunia.com/advisories/19800 · Note
• http://secunia.com/advisories/19872 · Note