PT-2007-3812 · Digium · Asterisk

Published 2007-05-07 · Updated 2017-07-29 · CVE-2007-2488

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Asterisk versions prior to 20070504

Description The issue is related to the IAX2 channel driver, which does not properly null terminate data. This allows remote attackers to trigger loss of transmitted data, and possibly obtain sensitive information, such as memory contents, or cause a denial of service, resulting in an application crash, by sending a frame that lacks a 0 byte.

Recommendations For versions prior to 20070504, update to a version released after 20070504 to resolve the issue.

Fix

Related Identifiers

CVE-2007-2488

DSA-1358-1

Affected Products

Asterisk

References · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2007-2488 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_34_asterisk.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-2488 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2488 · Security Note
• https://osv.dev/vulnerability/CVE-2007-2488 · Vendor Advisory
• http://debian.org/security/2007/dsa-1358 · Vendor Advisory
• http://securityfocus.com/bid/23824 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34085 · Note
• http://secunia.com/advisories/25134 · Note
• http://osvdb.org/35769 · Note
• http://secunia.com/advisories/25582 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2488 · Note
• http://ftp.digium.com/pub/asa/ASA-2007-013.pdf · Note
• http://vupen.com/english/advisories/2007/1661 · Note